Exploit
CVE-2024-8530

Missing Authentication for Critical Function (CWE-306)

Published: Oct 11, 2024 / Updated: 39d ago

010
CVSS 5.9EPSS 0.04%Medium
CVE info copied to clipboard

Summary

A vulnerability in Schneider Electric EcoStruxure Data Center Expert allows remote attackers to disclose sensitive information without requiring authentication. The specific flaw is in the handling of log files, where there is a lack of authentication prior to allowing access to functionality.

Impact

This vulnerability can be exploited by remote attackers to disclose sensitive information, which could lead to further compromise of the affected systems. The attack vector is network-based, and no user interaction is required. While the attack complexity is high, it does not require any privileges to exploit. The confidentiality impact is high, but there is no impact on integrity or availability.

Exploitation

One proof-of-concept exploit is available on zerodayinitiative.com. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Schneider Electric has released EcoStruxure IT Data Center Expert version 8.2.0, which addresses this vulnerability.

Mitigation

1. Update to EcoStruxure IT Data Center Expert version 8.2.0 or later. 2. Implement network segmentation and access controls to limit exposure of the affected systems. 3. Monitor log files and system access for any suspicious activities. 4. Implement strong authentication mechanisms for all critical functions. 5. Follow the principle of least privilege for user accounts and system access.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Timeline

First Article

Feedly found the first article mentioning CVE-2024-8530. See article

Oct 11, 2024 at 2:04 PM / CVE
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 11, 2024 at 2:04 PM
CVE Assignment

NVD published the first details for CVE-2024-8530

Oct 11, 2024 at 2:15 PM
CVSS

A CVSS base score of 5.9 has been assigned.

Oct 11, 2024 at 2:20 PM / nvd
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Oct 11, 2024 at 2:37 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.7%)

Oct 12, 2024 at 11:45 AM
Static CVE Timeline Graph

Affected Systems

Schneider-electric/data_center_expert
+null more

Exploits

https://www.zerodayinitiative.com/advisories/ZDI-24-1416/
+null more

Attack Patterns

CAPEC-12: Choosing Message Identifier
+null more

Vendor Advisory

ZDI-24-1416: Schneider Electric EcoStruxure Data Center Expert Missing Authentication Information Disclosure Vulnerability
The vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric EcoStruxure Data Center Expert. An attacker can leverage this vulnerability to disclose sensitive information, leading to further compromise.

News

Update Fri Oct 18 22:38:54 UTC 2024
Update Fri Oct 18 22:38:54 UTC 2024
ZDI-24-1416: Schneider Electric EcoStruxure Data Center Expert Missing Authentication Information Disclosure Vulnerability
The vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric EcoStruxure Data Center Expert. An attacker can leverage this vulnerability to disclose sensitive information, leading to further compromise.
CISA Releases ICS Advisories to Mitigate Cyber Attacks
The advisories focus on vulnerabilities in Siemens Siveillance Video Cameras and Schneider Electric Data Center Expert software. Successful exploitation of this vulnerability could enable attackers to execute arbitrary commands, potentially compromising critical infrastructure sectors where these cameras are deployed worldwide.
Schneider Electric Data Center Expert
Schneider Electric reports that the following versions of Data Center Expert, a monitoring software, are affected: A missing authentication for critical function vulnerability exists in Data Center Expert software that could cause exposure of private data when an already generated "logcaptures" archive is accessed directly by HTTPS.
NA - CVE-2024-8530 - CWE-306: Missing Authentication for Critical...
CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” archive is accessed directly by HTTPS.
See 7 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:High
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:None
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI