What’s Vulnerable › Vulnerabilities
CVE-2024-8935
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-11-13 · updated 2026-06-17
- Weakness: CWE-290
Description
CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integrity of controllers when conducting a Man-In-The-Middle attack between the controller and the engineering workstation while a valid user is establishing a communication session. This vulnerability is inherent to Diffie Hellman algorithm which does not protect against Man-In-The-Middle attacks.
Affected products
- Schneider-Electric Modicon M340 Bmxp341000: from SV3.60
- Schneider-Electric Modicon Mc80 Bmkc8020301: all versions
- Schneider-Electric Modicon Momentum Unity M1E Processor: all versions
References
Get alerted when CVE-2024-8935 or the next vulnerability affects your stack