CVE-2024-10575
📋 TL;DR
A missing authorization vulnerability (CWE-862) in Schneider Electric products allows unauthorized access when devices are network-enabled. This could enable attackers to compromise connected systems and devices. Organizations using affected Schneider Electric industrial control systems are at risk.
💻 Affected Systems
- Schneider Electric industrial control systems (specific models detailed in SEVD-2024-317-04)
📦 What is this software?
Ecostruxure It Gateway by Schneider Electric
Ecostruxure It Gateway by Schneider Electric
Ecostruxure It Gateway by Schneider Electric
Ecostruxure It Gateway by Schneider Electric
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to operational disruption, safety hazards, or data exfiltration from connected OT/IT networks.
Likely Case
Unauthorized access to device configurations, potential manipulation of industrial processes, and lateral movement to connected systems.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
Missing authorization suggests attackers could bypass authentication mechanisms without complex techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions specified in SEVD-2024-317-04 advisory
Vendor Advisory: https://download.schneider-electric.com/doc/SEVD-2024-317-04/SEVD-2024-317-04.pdf
Restart Required: Yes
Instructions:
1. Review SEVD-2024-317-04 advisory for affected products. 2. Apply vendor-provided patches/updates. 3. Restart affected systems. 4. Verify patch installation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices in separate network segments with strict access controls
Disable Network Interfaces
allDisable unnecessary network interfaces on devices not requiring network connectivity
🧯 If You Can't Patch
- Implement strict network access controls and firewall rules limiting connections to affected devices
- Monitor network traffic to/from affected devices for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check device model and version against SEVD-2024-317-04 advisory. Verify if network interfaces are enabled.Check Version:
Device-specific commands vary by product - refer to Schneider Electric documentationVerify Fix Applied:
Confirm installed version matches patched versions in advisory. Test authorization controls.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts
- Authentication bypass logs
- Configuration changes from unexpected sources
Network Indicators:
- Unexpected connections to industrial control ports
- Traffic patterns indicating enumeration of ICS devices
SIEM Query:
source="industrial_control" AND (event_type="auth_failure" OR event_type="config_change")