Description
CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated
user with access to the device’s web interface to perform unauthorized file and firmware
uploads when crafting custom web requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Sage 1410 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 1430 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 1450 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 2400 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 3030 Magnum | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 4400 | Versions C3414-500-S02K5_P8 and prior | — |
Advisories 3
- ICSA-25-107-02 Schneider Electric Sage Series CISA ICS & IT advisories · Jul 9, 2024
- SEVD-2024-163-05 SAGE RTU Schneider Electric CPCERT · Jul 9, 2024
- NCSC-2024-0244 Kwetsbaarheden verholpen in Schneider Electric Sage RTU systemen NCSC-NL (Netherlands) · Jun 11, 2024