Bmxnoe0100 Firmware
CVE-2024-5056
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem.
AnalysisAI
prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-552. prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem. Affected products include: Schneider-Electric Modicon M340 Firmware, Schneider-Electric Bmxnoe0100 Firmware, Schneider-Electric Bmxnoe0110 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Bmxnoe0100 Firmware
View allA CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy O
commands on the webserver without authentication when sending specially crafted HTTP requests. Rated critical severity (
A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BM
A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a speciall
A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attack
A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web
A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, L
A CWE-754:Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M340 CPUs (BMXP34* versio
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerabilit
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340,
A CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today