CVE-2024-11737 CRITICAL

CVE-2024-11737

Vendor Schneider Electric
Product Modicon Controllers M241 / M251
Weakness CWE-20 · Input validation
Published December 11, 2024
Last update December 11, 2024
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of the controller when an unauthenticated crafted Modbus packet is sent to the device.

Key dates

02Disclosure timeline

December 11, 2024 CVE published
December 11, 2024 Record updated