Description
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path
Traversal’) vulnerability exists that could allow an authenticated user with access to the device’s
web interface to corrupt files and impact device functionality when sending a crafted HTTP
request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Sage 1410 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 1430 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 1450 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 2400 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 3030 Magnum | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 4400 | Versions C3414-500-S02K5_P8 and prior | — |
Advisories 3
- ICSA-25-107-02 Schneider Electric Sage Series CISA ICS & IT advisories · Jul 9, 2024
- SEVD-2024-163-05 SAGE RTU Schneider Electric CPCERT · Jul 9, 2024
- NCSC-2024-0244 Kwetsbaarheden verholpen in Schneider Electric Sage RTU systemen NCSC-NL (Netherlands) · Jun 11, 2024