{"id":"CVE-2024-5056","state":"PUBLISHED","title":"CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may","description":"CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may\nprevent user to update the device firmware and prevent proper behavior of the webserver when\nspecific files or directories are removed from the filesystem.","publishedAt":"2024-06-12T12:10:43.250Z","updatedAt":"2024-08-01T21:03:10.683Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","source":"schneider"},"assigner":"schneider","products":["Schneider Electric Modicon M340","Schneider Electric Network module, Modicon M340, Modbus/TCP BMXNOE0100","Schneider Electric Network module, Modicon M340, Ethernet TCP/IP BMXNOE0110"],"affected":[{"vendor":"Schneider Electric","product":"Modicon M340","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]},{"vendor":"Schneider Electric","product":"Network module, Modicon M340, Modbus/TCP BMXNOE0100","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]},{"vendor":"Schneider Electric","product":"Network module, Modicon M340, Ethernet TCP/IP BMXNOE0110","defaultStatus":"unaffected","versions":[{"version":"All Versions","status":"affected"}]}],"references":["https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-01.pdf"],"weaknesses":["CWE-552"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/5xxx/CVE-2024-5056.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-5056","state":"PUBLISHED","datePublished":"2024-06-12T12:10:43.250Z","dateUpdated":"2024-08-01T21:03:10.683Z","assignerShortName":"schneider","assignerOrgId":"076d1eb6-cfab-4401-b34d-6dfc2a413bdb","dateReserved":"2024-05-17T10:06:08.565Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may\nprevent user to update the device firmware and prevent proper behavior of the webserver when\nspecific files or directories are removed from the filesystem."}],"affected":[{"vendor":"Schneider Electric","product":"Modicon M340","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]},{"vendor":"Schneider Electric","product":"Network module, Modicon M340, Modbus/TCP BMXNOE0100","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]},{"vendor":"Schneider Electric","product":"Network module, Modicon M340, Ethernet TCP/IP BMXNOE0110","defaultStatus":"unaffected","versions":[{"version":"All Versions","status":"affected"}]}],"references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-01.pdf"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-552","description":"CWE-552 Files or Directories Accessible to External Parties","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"schneider","orgId":"076d1eb6-cfab-4401-b34d-6dfc2a413bdb","dateUpdated":"2024-06-12T12:10:43.250Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"schneider-electric","product":"modicom_m340_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}],"cpes":["cpe:2.3:o:schneider-electric:modicom_m340_firmware:-:*:*:*:*:*:*:*"]},{"vendor":"schneider-electric","product":"modicom_m340","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}],"cpes":["cpe:2.3:h:schneider-electric:modicom_m340:-:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-12T14:14:02.243238Z","id":"CVE-2024-5056","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-12T14:17:06.480Z"}},{"title":"CVE Program Container","references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-01.pdf","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:03:10.683Z"}}]}}}