{"id":"CVE-2024-8419","state":"PUBLISHED","title":"Improper Access Control vulnerability in AC4xxS devices","description":"The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication.","publishedAt":"2025-06-30T09:39:50.792Z","updatedAt":"2026-02-16T15:43:48.124Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"CERTVDE"},"assigner":"CERTVDE","products":["ifm electronic GmbH ifm Smart PLC AC402s","ifm electronic GmbH ifm Smart PLC AC422s","ifm electronic GmbH ifm Smart PLC AC424s","ifm electronic GmbH ifm Smart PLC AC432s","ifm electronic GmbH ifm Smart PLC AC434s"],"affected":[{"vendor":"ifm electronic GmbH","product":"ifm Smart PLC AC402s","defaultStatus":"unaffected","versions":[{"version":"4.04","status":"affected","lessThan":"4.3.17","versionType":"semver"},{"version":"6.1.8","status":"affected"}]},{"vendor":"ifm electronic GmbH","product":"ifm Smart PLC AC422s","defaultStatus":"unaffected","versions":[{"version":"4.04","status":"affected","lessThan":"4.3.17","versionType":"semver"},{"version":"6.1.8","status":"affected"}]},{"vendor":"ifm electronic GmbH","product":"ifm Smart PLC AC424s","defaultStatus":"unaffected","versions":[{"version":"4.04","status":"affected","lessThan":"4.3.17","versionType":"semver"},{"version":"6.1.8","status":"affected"}]},{"vendor":"ifm electronic GmbH","product":"ifm Smart PLC AC432s","defaultStatus":"unaffected","versions":[{"version":"4.04","status":"affected","lessThan":"4.3.17","versionType":"semver"},{"version":"6.1.8","status":"affected"}]},{"vendor":"ifm electronic GmbH","product":"ifm Smart PLC AC434s","defaultStatus":"unaffected","versions":[{"version":"4.04","status":"affected","lessThan":"4.3.17","versionType":"semver"},{"version":"6.1.8","status":"affected"}]}],"references":["https://cert.vde.com/en/advisories/VDE-2024-061"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/8xxx/CVE-2024-8419.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-8419","state":"PUBLISHED","datePublished":"2025-06-30T09:39:50.792Z","dateUpdated":"2026-02-16T15:43:48.124Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2024-09-04T11:25:22.338Z"},"containers":{"cna":{"title":"Improper Access Control vulnerability in AC4xxS devices","descriptions":[{"lang":"en","value":"The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication."}],"affected":[{"vendor":"ifm electronic GmbH","product":"ifm Smart PLC AC402s","defaultStatus":"unaffected","versions":[{"version":"4.04","status":"affected","lessThan":"4.3.17","versionType":"semver"},{"version":"6.1.8","status":"affected"}]},{"vendor":"ifm electronic GmbH","product":"ifm Smart PLC AC422s","defaultStatus":"unaffected","versions":[{"version":"4.04","status":"affected","lessThan":"4.3.17","versionType":"semver"},{"version":"6.1.8","status":"affected"}]},{"vendor":"ifm electronic GmbH","product":"ifm Smart PLC AC424s","defaultStatus":"unaffected","versions":[{"version":"4.04","status":"affected","lessThan":"4.3.17","versionType":"semver"},{"version":"6.1.8","status":"affected"}]},{"vendor":"ifm electronic GmbH","product":"ifm Smart PLC AC432s","defaultStatus":"unaffected","versions":[{"version":"4.04","status":"affected","lessThan":"4.3.17","versionType":"semver"},{"version":"6.1.8","status":"affected"}]},{"vendor":"ifm electronic GmbH","product":"ifm Smart PLC AC434s","defaultStatus":"unaffected","versions":[{"version":"4.04","status":"affected","lessThan":"4.3.17","versionType":"semver"},{"version":"6.1.8","status":"affected"}]}],"references":[{"url":"https://cert.vde.com/en/advisories/VDE-2024-061"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2026-02-16T15:43:48.124Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Dmytro Kryhin"},{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"National Technical University of Ukraine “Igor Sikorsky Kyiv Polytechnic Institute”"}],"source":{"advisory":"VDE-2024-061","defect":["CERT@VDE#641687"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-30T15:01:59.417077Z","id":"CVE-2024-8419","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-30T15:07:50.934Z"}}]}}}