What’s Vulnerable › Vulnerabilities

CVE-2024-11425

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-17 · updated 2026-06-17
• Weakness: CWE-131

Description

CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the product when an unauthenticated user is sending a crafted HTTPS packet to the webserver.

Affected products

• Schneider Electric BMENOR2200H: all versions
• Schneider Electric EVLink Pro AC: Versions prior to v1.3.10
• Schneider Electric Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety): Versions prior to SV4.30
• Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S): Versions prior to SV4.21

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-01.pdf

Get alerted when CVE-2024-11425 or the next vulnerability affects your stack