CVE-2024-35293CWE-306

Schneider Elektronik Series 700 prone to missing authentication for critical reset function

Critical · published October 2, 2024

CVSS v3.1
9.1
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

🚨 An unauthenticated attacker can reboot or wipe your devices — just like someone flicking the power switch on a computer in a crowded office! 🔥 Think of it like a power outage during a busy workday; without proper authorization, anyone could pull the plug, leaving everyone in chaos. This vulnerability allows an attacker to erase data and cause a denial of service on the affected devices, which is absolutely devastating! If exploited, an attacker could remotely wipe your devices, erasing crucial data and leading to significant downtime. Imagine losing all your work in an instant or your devices becoming completely inoperable — that kind of chaos could disrupt operations and erode trust!

Put simply

Think of it like a power outage during a busy workday; without proper authorization, anyone could pull the plug, leaving everyone in chaos. This vulnerability allows an attacker to erase data and cause a denial of service on the affected devices, which is absolutely devastating! This vulnerability is due to missing authentication checks on critical functions, allowing unauthenticated users to execute commands that can force a reboot or erase devices.

What to do

If exploited, an attacker could remotely wipe your devices, erasing crucial data and leading to significant downtime. Imagine losing all your work in an instant or your devices becoming completely inoperable — that kind of chaos could disrupt operations and erode trust! Immediate action is required: patch to the latest firmware version to close this vulnerability and implement proper authentication checks for critical functions. Review your device configurations to ensure no unauthorized access is possible. This is essential for securing your systems! You’ve got this! By taking these steps, you’ll keep your devices safe and secure. 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00625 · 49.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2024-10-02T09:51Z
EPSS history
Timeline
  • 02 OCT 09:51Z
    Schneider Elektronik Series 700 prone to missing authentication for critical reset function
    cvelistv5