Skip to content
OpenAdvisories
Critical ICSA-24-291-01 4 CVEs

Elvaco M-Bus Metering Gateway CMe3100 (Update A)

Published Oct 17, 2024 · Updated Nov 14, 2024 · Revision 2

Vendor: Elvaco Product: CMe3100

Summary

Successful exploitation of these vulnerabilities could allow an attacker to perform remote code execution, impersonate and send false information, or bypass authentication.

Vulnerabilities 4

  • Critical 9.2
    CVE-2024-49397

    Cross-site Scripting in Elvaco M-Bus Metering Gateway CMe3100

    The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin accounts.

    Elvaco M-Bus Metering Gateway CMe3100
  • High 8.8
    CVE-2024-49398

    Unrestricted Upload of File with Dangerous Type in Elvaco M-Bus Metering Gateway CMe3100

    The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code.

    Elvaco M-Bus Metering Gateway CMe3100
  • High 8.7
    CVE-2024-49396

    Insufficiently Protected Credentials in Elvaco M-Bus Metering Gateway CMe3100

    The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information.

    Elvaco M-Bus Metering Gateway CMe3100
  • High 8.7
    CVE-2024-49399

    Missing Authentication for Critical Function in Elvaco M-Bus Metering Gateway CMe3100

    The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak information.

    Elvaco M-Bus Metering Gateway CMe3100

Revision history

  1. #2

    Update A - Mitigation information added.

  2. #1

    Initial Publication

References