Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2024-37040: CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to the device’s web interface to cause a fault on the device...
CVE-2024-37040 · published 2 years ago
Summary
CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability
exists that could allow a user with access to the device’s web interface to cause a fault on the
device when sending a malformed HTTP request.
What to do
- Update schneider-electric sage_rtu_firmware to version c3414-500-s02k5_p9 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| schneider-electric | sage_rtu_firmware |
< c3414-500-s02k5_p9 cpe:2.3:o:schneider-electric:sage_rtu_firmware:*:*:*:*:*:*:*:* |
Original advisory text
CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability
exists that could allow a user with access to the device’s web interface to cause a fault on the
device...
CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability
exists that could allow a user with access to the device’s web interface to cause a fault on the
device when sending a malformed HTTP request.
exists that could allow a user with access to the device’s web interface to cause a fault on the
device when sending a malformed HTTP request.
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDoc... Patch Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-120Classic Buffer Overflow
Timeline
Published12 Jun 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-37040 · NVD
Track software like this
Free during beta