High severity · published Sep 18, 2024
CVE-2024-34057
Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing received messages
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing received messages. The resulting buffer overflow can cause a crash, resulting in a denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
I6
Iec 61850 Source Code Library · Trianglemicroworks
before 12.2.0 · source: NVD
SA
Sicam A8000 Firmware · Siemens
before 05.30 · source: NVD
SE
Sicam Egs Firmware · Siemens
before 05.30 · source: NVD
SS
Sicam S8000 · Siemens
before 05.30 · source: NVD
SS
Sicam Scc Firmware · Siemens
before 10.0 · source: NVD
SA
Sitipe AT · Siemens
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-34057
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-34057
Release Notes
https://trianglemicroworks.com/products/source-code-libraries/iec-61850-scl-pages/what%27s-new
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-16
More from Sicam A8000 Firmware
9.6
CVE-2020-15781
A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30)