Medium severity · published Sep 13, 2024
CVE-2024-31416
The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc. Some of these input fields were not checking the length and bounds of the entered value. The exploit of this security flaw by a bad actor may result in excessive memory consumption or integer overflow.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Foreseer Electrical Power Monitoring System · Eaton
before 7.8.600 · source: NVD
Affected product
FE
Foreseer Electrical Power Monitoring System
Eaton
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31416
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31416
Vendor Advisory
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1008.pdf
More from Foreseer Electrical Power Monitoring System
9.8
CVE-2022-33859
Unrestricted file upload in Eaton Foreseer EPMS
8.1
CVE-2024-31415
The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc
6.1
CVE-2024-31414
The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages