CVE-2024-37038: schneider electric sage 1410 Incorrect Default Permissions
CVSS: 8.8v3.1HighModified
Published 12-06-2024Last modified 02-08-2024
Vulnerability summary
CVE-2024-37038 is a high (CVSS 8.8) Incorrect Default Permissions vulnerability in schneider electric sage 1410. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.8% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
0.37%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 12-06-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources2 sources · 7.5–8.8
- CVE.orgCNA7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
0.00 pp
From 0.37% on 20-09-2026
20-09-202620-10-2026
EPSS score0.37%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Schneider electric6 products
- sage 1410Versions C3414-500-S02K5_P8 and prior
- sage 1430Versions C3414-500-S02K5_P8 and prior
- sage 1450Versions C3414-500-S02K5_P8 and prior
- sage 2400Versions C3414-500-S02K5_P8 and prior
- sage 3030 magnumVersions C3414-500-S02K5_P8 and prior
Schneider-electric1 product
- sage_rtu_firmware< c3414-500-s02k5_p9
2 vendors · 7 products