{"id":"CVE-2024-5313","state":"PUBLISHED","title":"CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH","description":"CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH\ninterface over the product network interface. This does not allow to directly exploit the product or\nmake any unintended operation as the SSH interface access is protected by an authentication\nmechanism. Impacts are limited to port scanning and fingerprinting activities as well as attempts\nto perform a potential denial of service attack on the exposed SSH interface.","publishedAt":"2024-06-12T12:14:58.979Z","updatedAt":"2024-08-01T21:11:12.332Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","source":"schneider"},"assigner":"schneider","products":["Schneider Electric EVlink Home Smart"],"affected":[{"vendor":"Schneider Electric","product":"EVlink Home Smart","defaultStatus":"unaffected","versions":[{"version":"v2.0.4.1.2_131","status":"affected"},{"version":"v2.0.3.8.2_128","status":"affected"}]}],"references":["https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-03.pdf"],"weaknesses":["CWE-668"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/5xxx/CVE-2024-5313.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-5313","state":"PUBLISHED","datePublished":"2024-06-12T12:14:58.979Z","dateUpdated":"2024-08-01T21:11:12.332Z","assignerShortName":"schneider","assignerOrgId":"076d1eb6-cfab-4401-b34d-6dfc2a413bdb","dateReserved":"2024-05-24T08:29:40.058Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH\ninterface over the product network interface. This does not allow to directly exploit the product or\nmake any unintended operation as the SSH interface access is protected by an authentication\nmechanism. Impacts are limited to port scanning and fingerprinting activities as well as attempts\nto perform a potential denial of service attack on the exposed SSH interface."}],"affected":[{"vendor":"Schneider Electric","product":"EVlink Home Smart","defaultStatus":"unaffected","versions":[{"version":"v2.0.4.1.2_131","status":"affected"},{"version":"v2.0.3.8.2_128","status":"affected"}]}],"references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-03.pdf"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-668","description":"CWE-668 Exposure of Resource to Wrong Sphere","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"schneider","orgId":"076d1eb6-cfab-4401-b34d-6dfc2a413bdb","dateUpdated":"2024-06-12T12:14:58.979Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"schneider-electric","product":"evlink_home_smart","defaultStatus":"unknown","versions":[{"version":"2.0.4.1.2_131","status":"affected"},{"version":"2.0.3.8.2_128","status":"affected"}],"cpes":["cpe:2.3:a:schneider-electric:evlink_home_smart:2.0.4.1.2_131:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-12T14:57:54.307091Z","id":"CVE-2024-5313","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-12T15:04:51.869Z"}},{"title":"CVE Program Container","references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-03.pdf","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:11:12.332Z"}}]}}}