{"schemaVersion":3,"id":"CVE-2024-8937","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could\ncause a potential arbitrary code execution after a successful Man-In-The Middle attack followed by sending a\ncrafted Modbus function call to tamper with memory area involved in the authentication process.","dates":{"published":"2024-11-13T04:17:30.614Z","modified":"2024-11-13T15:27:59.982Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.3,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.3,"severity":"high","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.3,"severity":"high","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00586,"percentile":0.46968,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00586},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00586,"percentile":0.46968}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00586,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00586,"percentile":0.46968}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"schneider electric","product":"modicon m340 cpu (part numbers bmxp34*)","name":"Modicon M340 CPU (part numbers BMXP34*)","label":"modicon m340 cpu (part numbers bmxp34*)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"Versions prior to SV3.65","noFixRecorded":false,"fixedIn":null}],"versionsText":"Versions prior to SV3.65","eol":null,"hubHref":"/vendor/schneider_electric/modicon_m340_cpu_part_numbers_bmxp34"},{"vendor":"schneider electric","product":"modicon mc80 (part numbers bmkc80)","name":"Modicon MC80 (part numbers BMKC80)","label":"modicon mc80 (part numbers bmkc80)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":"/vendor/schneider_electric/modicon_mc80_part_numbers_bmkc80"},{"vendor":"schneider electric","product":"modicon momentum unity m1e processor (171cbu*)","name":"Modicon Momentum Unity M1E Processor (171CBU*)","label":"modicon momentum unity m1e processor (171cbu*)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":"/vendor/schneider_electric/modicon_momentum_unity_m1e_processor_171cbu"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://download.schneider-electric.com/doc/SEVD-2024-317-03/SEVD-2024-317-03.pdf","label":"download.schneider-electric.com/doc/SEVD-2024-317-03/SEVD-2024-317-03.pdf","hostname":"download.schneider-electric.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2024-11-13T04:17:30.614Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-11-13T15:27:59.982Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":33,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:19:30.709Z","stale":false,"partial":false}}