Medium severity · published Sep 13, 2024
CVE-2024-31414
The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton Foreseer software lacked proper input sanitization on the server-side, which could lead to injection and execution of malicious scripts when abused by bad actors.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Foreseer Electrical Power Monitoring System · Eaton
before 7.8.600 · source: NVD
Affected product
FE
Foreseer Electrical Power Monitoring System
Eaton
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31414
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31414
Vendor Advisory
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1008.pdf
More from Foreseer Electrical Power Monitoring System
9.8
CVE-2022-33859
Unrestricted file upload in Eaton Foreseer EPMS
8.1
CVE-2024-31415
The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc
6.5
CVE-2024-31416
The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc