Schneider Electric PowerLogic HDPM6000 Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2024-10498)

medium Tenable OT Security Plugin ID 502849

Synopsis

The remote OT asset is affected by a vulnerability.

Description

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow an unauthorized attacker to modify configuration values outside of the normal range when the attacker sends specific Modbus write packets to the device which could result in invalid data or loss of web interface functionality.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

- Schneider Electric Power Logic HDPM6000 Versions 0.62.7 and prior:
Version v0.62.11 and newer of HDPM6000 includes a fix for these vulnerabilities and is available for download.
A device restart will occur as part of the firmware update process if conducted through the web user interface.
If the upgrade is performed using the HDPM6000 Manager software, the device will need to be restarted manually to apply the update.

- Schneider Electric Power Logic HDPM6000 Version 0.62.7 only:
If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
Ensure that the device is not accessible via the Modbus protocol outside the local network segment by applying appropriate firewalls configuration and controls, and that access to the network segment is protected and controlled.

For more information, please see Schneider Electric's advisory.

Plugin Details

Severity: Medium

ID: 502849

Version: 1.2

Type: remote

Family: Tenable.ot

Published: 2/17/2025

Updated: 2/19/2025

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 2.5

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:schneider-electric:powerlogic_hdpm6000_firmware

Required KB Items: Tenable.ot/Schneider

Exploit Ease: No known exploits are available

Patch Publication Date: 1/17/2025

Vulnerability Publication Date: 1/17/2025

Reference Information

CVE: CVE-2024-10498

CWE: 119

ICSA: 25-028-02

Detections

Analytics