Vulnerability-Lookup

CVE-2024-9409 (GCVE-0-2024-9409)

Vulnerability from cvelistv5 – Published: 2024-11-13 04:29 – Updated: 2024-11-13 14:43

Summary

CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communication loss when a large amount of IGMP packets is present in the network.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-13 14:40 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

schneider mitre root

References

1 reference

URL	Tags
https://download.schneider-electric.com/doc/SEVD-…

Impacted products

6 products

Vendor	Product	Version	CPE status
Schneider Electric	PowerLogic PM5320	Affected: Version 2.3.8 and prior	guessed
Schneider Electric	PowerLogic PM5340	Affected: Version 2.3.8 and prior	guessed
Schneider Electric	PowerLogic PM5341	Affected: Version 2.6.6 and prior	guessed
schneider-electric	powerlogic_pm5320	Affected: 0 , ≤ 2.3.8 (custom) cpe:2.3:h:schneider-electric:powerlogic_pm5320::::::::
schneider-electric	powerlogic_pm5340	Affected: 0 , ≤ 2.3.8 (custom) cpe:2.3:h:schneider-electric:powerlogic_pm5340::::::::
schneider-electric	powerlogic_pm5341	Affected: 0 , ≤ 2.6.6 (custom) cpe:2.3:h:schneider-electric:powerlogic_pm5341::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:h:schneider-electric:powerlogic_pm5320:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "powerlogic_pm5320",
            "vendor": "schneider-electric",
            "versions": [
              {
                "lessThanOrEqual": "2.3.8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider-electric:powerlogic_pm5340:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "powerlogic_pm5340",
            "vendor": "schneider-electric",
            "versions": [
              {
                "lessThanOrEqual": "2.3.8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider-electric:powerlogic_pm5341:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "powerlogic_pm5341",
            "vendor": "schneider-electric",
            "versions": [
              {
                "lessThanOrEqual": "2.6.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9409",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T14:40:24.630364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-13T14:43:17.912Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PowerLogic PM5320",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Version 2.3.8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PowerLogic PM5340",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Version 2.3.8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PowerLogic PM5341",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Version 2.6.6 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become\nunresponsive resulting in communication loss when a large amount of IGMP packets is present in the network.\n\n\u003cbr\u003e"
            }
          ],
          "value": "CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become\nunresponsive resulting in communication loss when a large amount of IGMP packets is present in the network."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-13T04:29:01.040Z",
        "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
        "shortName": "schneider"
      },
      "references": [
        {
          "url": "https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
    "assignerShortName": "schneider",
    "cveId": "CVE-2024-9409",
    "datePublished": "2024-11-13T04:29:01.040Z",
    "dateReserved": "2024-10-01T12:08:25.066Z",
    "dateUpdated": "2024-11-13T14:43:17.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-9409",
      "date": "2026-09-20",
      "epss": "0.00816",
      "percentile": "0.55558"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:schneider-electric:powerlogic_pm5341_firmware:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2C518E91-E251-4278-83D6-144B1CC6331F",
                  "versionEndExcluding": "2.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:schneider-electric:powerlogic_pm5341:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9C575247-0AE3-408C-8154-71A256FD0292",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:schneider-electric:powerlogic_pm5340_firmware:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "65E456CF-4247-4FB9-858D-6920EF946CF2",
                  "versionEndExcluding": "2.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:schneider-electric:powerlogic_pm5340:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F5C8EA2A-37CF-435F-A1ED-789255404CD6",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:schneider-electric:powerlogic_pm5320_firmware:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "EB64AE9B-637D-48A5-AE98-6F120C7E355A",
                  "versionEndExcluding": "2.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:schneider-electric:powerlogic_pm5320:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "47592B0C-9E15-4D4C-B284-F2390678E1AC",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become\nunresponsive resulting in communication loss when a large amount of IGMP packets is present in the network."
        },
        {
          "lang": "es",
          "value": "CWE-400: Existe una vulnerabilidad de consumo descontrolado de recursos que podr\u00eda provocar que el dispositivo deje de responder y produzca p\u00e9rdida de comunicaci\u00f3n cuando hay una gran cantidad de paquetes IGMP en la red."
        }
      ],
      "id": "CVE-2024-9409",
      "lastModified": "2024-11-19T15:59:21.690",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "source": "cybersecurity@se.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ],
        "cvssMetricV40": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackRequirements": "NONE",
              "attackVector": "NETWORK",
              "automatable": "NOT_DEFINED",
              "availabilityRequirements": "NOT_DEFINED",
              "baseScore": 8.7,
              "baseSeverity": "HIGH",
              "confidentialityRequirements": "NOT_DEFINED",
              "exploitMaturity": "NOT_DEFINED",
              "integrityRequirements": "NOT_DEFINED",
              "modifiedAttackComplexity": "NOT_DEFINED",
              "modifiedAttackRequirements": "NOT_DEFINED",
              "modifiedAttackVector": "NOT_DEFINED",
              "modifiedPrivilegesRequired": "NOT_DEFINED",
              "modifiedSubsequentSystemAvailability": "NOT_DEFINED",
              "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED",
              "modifiedSubsequentSystemIntegrity": "NOT_DEFINED",
              "modifiedUserInteraction": "NOT_DEFINED",
              "modifiedVulnerableSystemAvailability": "NOT_DEFINED",
              "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED",
              "modifiedVulnerableSystemIntegrity": "NOT_DEFINED",
              "privilegesRequired": "NONE",
              "providerUrgency": "NOT_DEFINED",
              "recovery": "NOT_DEFINED",
              "safety": "NOT_DEFINED",
              "subsequentSystemAvailability": "NONE",
              "subsequentSystemConfidentiality": "NONE",
              "subsequentSystemIntegrity": "NONE",
              "userInteraction": "NONE",
              "valueDensity": "NOT_DEFINED",
              "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
              "version": "4.0",
              "vulnerabilityResponseEffort": "NOT_DEFINED",
              "vulnerableSystemAvailability": "HIGH",
              "vulnerableSystemConfidentiality": "NONE",
              "vulnerableSystemIntegrity": "NONE"
            },
            "source": "cybersecurity@se.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-11-13T05:15:27.610",
      "references": [
        {
          "source": "cybersecurity@se.com",
          "tags": [
            "Mitigation",
            "Patch",
            "Vendor Advisory"
          ],
          "url": "https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf"
        }
      ],
      "sourceIdentifier": "cybersecurity@se.com",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-400"
            }
          ],
          "source": "cybersecurity@se.com",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "PowerLogic PM5320",
                "vendor": "Schneider Electric",
                "versions": [
                  {
                    "status": "affected",
                    "version": "Version 2.3.8 and prior"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "PowerLogic PM5340",
                "vendor": "Schneider Electric",
                "versions": [
                  {
                    "status": "affected",
                    "version": "Version 2.3.8 and prior"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "PowerLogic PM5341",
                "vendor": "Schneider Electric",
                "versions": [
                  {
                    "status": "affected",
                    "version": "Version 2.6.6 and prior"
                  }
                ]
              }
            ],
            "source": "cybersecurity@se.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:h:schneider-electric:powerlogic_pm5320:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "powerlogic_pm5320",
                "vendor": "schneider-electric",
                "versions": [
                  {
                    "lessThanOrEqual": "2.3.8",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:h:schneider-electric:powerlogic_pm5340:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "powerlogic_pm5340",
                "vendor": "schneider-electric",
                "versions": [
                  {
                    "lessThanOrEqual": "2.3.8",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:h:schneider-electric:powerlogic_pm5341:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "powerlogic_pm5341",
                "vendor": "schneider-electric",
                "versions": [
                  {
                    "lessThanOrEqual": "2.6.6",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:schneider-electric:powerlogic_pm5341_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2C518E91-E251-4278-83D6-144B1CC6331F",
                    "versionEndExcluding": "2.7.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:schneider-electric:powerlogic_pm5341:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9C575247-0AE3-408C-8154-71A256FD0292",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:schneider-electric:powerlogic_pm5340_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "65E456CF-4247-4FB9-858D-6920EF946CF2",
                    "versionEndExcluding": "2.4.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:schneider-electric:powerlogic_pm5340:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F5C8EA2A-37CF-435F-A1ED-789255404CD6",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:schneider-electric:powerlogic_pm5320_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EB64AE9B-637D-48A5-AE98-6F120C7E355A",
                    "versionEndExcluding": "2.4.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:schneider-electric:powerlogic_pm5320:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "47592B0C-9E15-4D4C-B284-F2390678E1AC",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become\nunresponsive resulting in communication loss when a large amount of IGMP packets is present in the network."
          },
          {
            "lang": "es",
            "value": "CWE-400: Existe una vulnerabilidad de consumo descontrolado de recursos que podr\u00eda provocar que el dispositivo deje de responder y produzca p\u00e9rdida de comunicaci\u00f3n cuando hay una gran cantidad de paquetes IGMP en la red."
          }
        ],
        "id": "CVE-2024-9409",
        "lastModified": "2026-06-17T08:24:31.077",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "cybersecurity@se.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "cybersecurity@se.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-9409",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T14:40:24.630364Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-11-13T05:15:27.610",
        "references": [
          {
            "source": "cybersecurity@se.com",
            "tags": [
              "Mitigation",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf"
          }
        ],
        "sourceIdentifier": "cybersecurity@se.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "cybersecurity@se.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T18:31:36+00:00",
      "cve": "CVE-2024-9409",
      "id": "CVE-2024-9409",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-9409",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-9409.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:h:schneider-electric:powerlogic_pm5320:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "powerlogic_pm5320",
                "vendor": "schneider-electric",
                "versions": [
                  {
                    "lessThanOrEqual": "2.3.8",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:h:schneider-electric:powerlogic_pm5340:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "powerlogic_pm5340",
                "vendor": "schneider-electric",
                "versions": [
                  {
                    "lessThanOrEqual": "2.3.8",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:h:schneider-electric:powerlogic_pm5341:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "powerlogic_pm5341",
                "vendor": "schneider-electric",
                "versions": [
                  {
                    "lessThanOrEqual": "2.6.6",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-9409",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-11-13T14:40:24.630364Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-11-13T14:43:06.004Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "PowerLogic PM5320",
              "vendor": "Schneider Electric",
              "versions": [
                {
                  "status": "affected",
                  "version": "Version 2.3.8 and prior"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "PowerLogic PM5340",
              "vendor": "Schneider Electric",
              "versions": [
                {
                  "status": "affected",
                  "version": "Version 2.3.8 and prior"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "PowerLogic PM5341",
              "vendor": "Schneider Electric",
              "versions": [
                {
                  "status": "affected",
                  "version": "Version 2.6.6 and prior"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become\nunresponsive resulting in communication loss when a large amount of IGMP packets is present in the network.\n\n\u003cbr\u003e"
                }
              ],
              "value": "CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become\nunresponsive resulting in communication loss when a large amount of IGMP packets is present in the network."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "CWE-400 Uncontrolled Resource Consumption",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-11-13T04:29:01.040Z",
            "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
            "shortName": "schneider"
          },
          "references": [
            {
              "url": "https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
        "assignerShortName": "schneider",
        "cveId": "CVE-2024-9409",
        "datePublished": "2024-11-13T04:29:01.040Z",
        "dateReserved": "2024-10-01T12:08:25.066Z",
        "dateUpdated": "2024-11-13T14:43:17.912Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2025-00115 (CVE-2024-9409)

Vulnerability from fstec – Published: 2025-01-10 – Updated: 2025-01-10 – View on bdu.fstec.ru Fixed

Title

Уязвимость микропрограммного обеспечения измерителей мощности Schneider Electric PowerLogic PM5320, PM5340 и PM5341, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость микропрограммного обеспечения измерителей мощности Schneider Electric PowerLogic PM5320, PM5340 и PM5341 связана с неконтролируемым расходом ресурсов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании путем отправки специально созданных IGMP пакетов

Severity

7.8 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High) CVSS 4.0


                      
                        CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource exhaustion

Incidents

Being clarified

Remediation

Software update

CWE

CWE-400 - Неконтролируемый расход ресурса («Истощение ресурса»)

Aliases

CVE-2024-9409, SEVD-2024-317-01

References

5 references

URL
https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf
https://www.se.com/ww/en/product/METSEPM5320/power-meter-powerlogic-pm5320-ethe…
https://www.se.com/ww/en/product/METSEPM5340/power-meter-powerlogic-pm5340-ethe…
https://www.se.com/ww/en/product/METSEPM5341/pm5341-meter-ethernet-up-to-31st-h…
https://vuldb.com/?id.284303

Impacted products

3 products from 1 vendor

Vendors

Schneider Electric

Products

PowerLogic PM5320, PowerLogic PM5340, PowerLogic PM5341

Versions

до 2.3.8 включительно (PowerLogic PM5320), до 2.3.8 включительно (PowerLogic PM5340), до 2.6.6 включительно (PowerLogic PM5341)

Product types

ПО программно-аппаратного средства АСУ ТП

Mitigations

Использование рекомендаций производителя: https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf https://www.se.com/ww/en/product/METSEPM5320/power-meter-powerlogic-pm5320-ethernet-up-to-31st-harmonic-256kb-2di-2do-35-alarms/ https://www.se.com/ww/en/product/METSEPM5340/power-meter-powerlogic-pm5340-ethernet-up-to-31st-harmonic-256kb-2di-2do-35-alarms/ https://www.se.com/ww/en/product/METSEPM5341/pm5341-meter-ethernet-up-to-31st-h-256k-2di-2do-35-alarms-mid/

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": "AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Schneider Electric",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 2.3.8 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (PowerLogic PM5320), \u0434\u043e 2.3.8 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (PowerLogic PM5340), \u0434\u043e 2.6.6 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (PowerLogic PM5341)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf\nhttps://www.se.com/ww/en/product/METSEPM5320/power-meter-powerlogic-pm5320-ethernet-up-to-31st-harmonic-256kb-2di-2do-35-alarms/\nhttps://www.se.com/ww/en/product/METSEPM5340/power-meter-powerlogic-pm5340-ethernet-up-to-31st-harmonic-256kb-2di-2do-35-alarms/\nhttps://www.se.com/ww/en/product/METSEPM5341/pm5341-meter-ethernet-up-to-31st-h-256k-2di-2do-35-alarms-mid/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "01.10.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "10.01.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "10.01.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-00115",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-9409, SEVD-2024-317-01",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "PowerLogic PM5320, PowerLogic PM5340, PowerLogic PM5341",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u0440\u0438\u0442\u0435\u043b\u0435\u0439 \u043c\u043e\u0449\u043d\u043e\u0441\u0442\u0438 Schneider Electric PowerLogic PM5320, PM5340 \u0438 PM5341, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u0440\u0430\u0441\u0445\u043e\u0434\u043e\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0440\u0430\u0441\u0445\u043e\u0434 \u0440\u0435\u0441\u0443\u0440\u0441\u0430 (\u00ab\u0418\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u00bb) (CWE-400)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u0440\u0438\u0442\u0435\u043b\u0435\u0439 \u043c\u043e\u0449\u043d\u043e\u0441\u0442\u0438 Schneider Electric PowerLogic PM5320, PM5340 \u0438 PM5341 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u0440\u0430\u0441\u0445\u043e\u0434\u043e\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 IGMP \u043f\u0430\u043a\u0435\u0442\u043e\u0432",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf\nhttps://www.se.com/ww/en/product/METSEPM5320/power-meter-powerlogic-pm5320-ethernet-up-to-31st-harmonic-256kb-2di-2do-35-alarms/\nhttps://www.se.com/ww/en/product/METSEPM5340/power-meter-powerlogic-pm5340-ethernet-up-to-31st-harmonic-256kb-2di-2do-35-alarms/\nhttps://www.se.com/ww/en/product/METSEPM5341/pm5341-meter-ethernet-up-to-31st-h-256k-2di-2do-35-alarms-mid/\nhttps://vuldb.com/?id.284303",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0410\u0421\u0423 \u0422\u041f",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-400",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 4.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,7)"
}

FKIE_CVE-2024-9409

Vulnerability from fkie_nvd - Published: 2024-11-13 05:15 - Updated: 2026-06-17 08:24

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	cybersecurity@se.com	https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf	Mitigation, Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
schneider-electric	powerlogic_pm5341_firmware	*
schneider-electric	powerlogic_pm5341	-
schneider-electric	powerlogic_pm5340_firmware	*
schneider-electric	powerlogic_pm5340	-
schneider-electric	powerlogic_pm5320_firmware	*
schneider-electric	powerlogic_pm5320	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "PowerLogic PM5320",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Version 2.3.8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PowerLogic PM5340",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Version 2.3.8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PowerLogic PM5341",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Version 2.6.6 and prior"
            }
          ]
        }
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:h:schneider-electric:powerlogic_pm5320:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "powerlogic_pm5320",
          "vendor": "schneider-electric",
          "versions": [
            {
              "lessThanOrEqual": "2.3.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:h:schneider-electric:powerlogic_pm5340:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "powerlogic_pm5340",
          "vendor": "schneider-electric",
          "versions": [
            {
              "lessThanOrEqual": "2.3.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:h:schneider-electric:powerlogic_pm5341:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "powerlogic_pm5341",
          "vendor": "schneider-electric",
          "versions": [
            {
              "lessThanOrEqual": "2.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:powerlogic_pm5341_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C518E91-E251-4278-83D6-144B1CC6331F",
              "versionEndExcluding": "2.7.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:powerlogic_pm5341:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C575247-0AE3-408C-8154-71A256FD0292",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:powerlogic_pm5340_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "65E456CF-4247-4FB9-858D-6920EF946CF2",
              "versionEndExcluding": "2.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:powerlogic_pm5340:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5C8EA2A-37CF-435F-A1ED-789255404CD6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:powerlogic_pm5320_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB64AE9B-637D-48A5-AE98-6F120C7E355A",
              "versionEndExcluding": "2.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:powerlogic_pm5320:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "47592B0C-9E15-4D4C-B284-F2390678E1AC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become\nunresponsive resulting in communication loss when a large amount of IGMP packets is present in the network."
    },
    {
      "lang": "es",
      "value": "CWE-400: Existe una vulnerabilidad de consumo descontrolado de recursos que podr\u00eda provocar que el dispositivo deje de responder y produzca p\u00e9rdida de comunicaci\u00f3n cuando hay una gran cantidad de paquetes IGMP en la red."
    }
  ],
  "id": "CVE-2024-9409",
  "lastModified": "2026-06-17T08:24:31.077",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "cybersecurity@se.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cybersecurity@se.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-9409",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-11-13T14:40:24.630364Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-11-13T05:15:27.610",
  "references": [
    {
      "source": "cybersecurity@se.com",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf"
    }
  ],
  "sourceIdentifier": "cybersecurity@se.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "cybersecurity@se.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3C94-GHVC-4J26

Vulnerability from github – Published: 2024-11-13 06:30 – Updated: 2024-11-13 06:30

Details

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-9409"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-13T05:15:27Z",
    "severity": "HIGH"
  },
  "details": "CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become\nunresponsive resulting in communication loss when a large amount of IGMP packets is present in the network.",
  "id": "GHSA-3c94-ghvc-4j26",
  "modified": "2024-11-13T06:30:29Z",
  "published": "2024-11-13T06:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9409"
    },
    {
      "type": "WEB",
      "url": "https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

ICSA-24-326-06

Vulnerability from csaf_cisa - Published: 2024-11-12 00:00 - Updated: 2024-11-12 00:00

Summary

Schneider Electric PowerLogic PM5300 Series

Scope

1 vulnerability in this advisory, including CVE-2024-9409.

CVE-2024-9409

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 3 products Known affected: 3 products

https://www.se.com/ww/en/product/METSEPM5320/power-meter-po… https://www.se.com/ww/en/product/METSEPM5340/power-meter-po… https://www.se.com/ww/en/product/METSEPM5341/pm5341-meter-e…

Open the full advisory

SEVD-2024-317-01

Vulnerability from csaf_se - Published: 2024-11-12 00:00 - Updated: 2024-11-12 00:00

Summary

PowerLogic PM5300 Series

Scope

1 vulnerability in this advisory, including CVE-2024-9409.

CVE-2024-9409

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Known affected: 3 products Fixed: 3 products

https://www.se.com/ww/en/product/METSEPM5320/power-meter-po… https://www.se.com/ww/en/product/METSEPM5340/power-meter-po… https://www.se.com/ww/en/product/METSEPM5341/pm5341-meter-e…

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-9409 (GCVE-0-2024-9409)

BDU:2025-00115 (CVE-2024-9409)

FKIE_CVE-2024-9409

GHSA-3C94-GHVC-4J26

ICSA-24-326-06

SEVD-2024-317-01

Tags

Sightings

Nomenclature

Related by attack behaviour