Description
CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability
exists that could allow a user with access to the device’s web interface to cause a fault on the
device when sending a malformed HTTP request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Sage 1410 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 1430 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 1450 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 2400 | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 3030 Magnum | Versions C3414-500-S02K5_P8 and prior | — |
| Schneider Electric | Sage 4400 | Versions C3414-500-S02K5_P8 and prior | — |
Advisories 3
- ICSA-25-107-02 Schneider Electric Sage Series CISA ICS & IT advisories · Jul 9, 2024
- SEVD-2024-163-05 SAGE RTU Schneider Electric CPCERT · Jul 9, 2024
- NCSC-2024-0244 Kwetsbaarheden verholpen in Schneider Electric Sage RTU systemen NCSC-NL (Netherlands) · Jun 11, 2024