2Tma310010B0001 Firmware CVE-2024-4009

Q: What is the CVSS score of CVE-2024-4009?

CVE-2024-4009 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:D/RE:M/U:Green. EPSS exploitation probability: 0.1%.

HIGH

Authentication Bypass by Capture-replay (CWE-294)

2024-06-05 cybersecurity@ch.abb.com

Abb Information Disclosure 2Tma310010B0001 Firmware 2Tma310011B0001 Firmware 2Tma310011B0002 Firmware 2Tma310010B0003 Firmware 2Tma310011B0003 Firmware

7.3

CVSS 4.0 · Vendor: ch

Severity by source

Vendor (ch) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:D/RE:M/U:Green

Primary rating from Vendor (ch) · only source for this CVE.

CVSS VectorVendor: ch

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:D/RE:M/U:Green

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Jun 05, 2024 - 18:15 cve.org

HIGH 7.3

DescriptionCVE.org

Replay Attack

in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System

AnalysisAI

Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System. Rated high severity (CVSS 7.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-294. Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System Affected products include: Abb 2Tma310010B0001 Firmware, Abb 2Tma310011B0001 Firmware, Abb 2Tma310011B0002 Firmware, Abb 2Tma310010B0003 Firmware, Abb 2Tma310011B0003 Firmware. Version information: version 1.00.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.