High severity · published Sep 13, 2024
CVE-2024-31415
The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc
8.1
CVSS
0.1%
EPSS
No
On KEV
Description
The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on the host machine. However, the keys used for this encryption were insecurely stored, which could be abused to possibly change or remove the server configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Foreseer Electrical Power Monitoring System · Eaton
before 7.8.600 · source: NVD
Affected product
FE
Foreseer Electrical Power Monitoring System
Eaton
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31415
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31415
Mitigation
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1008.pdf
More from Foreseer Electrical Power Monitoring System
9.8
CVE-2022-33859
Unrestricted file upload in Eaton Foreseer EPMS
6.5
CVE-2024-31416
The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc
6.1
CVE-2024-31414
The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages
