« Volver al listado

CVE-2024-5313

Estado: ModificadaMedia (6.5)—

CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This does not allow to directly exploit the product or make any unintended operation as the SSH interface access is protected by an authentication mechanism. Impacts are limited to port scanning and fingerprinting activities as well as attempts to perform a potential denial of service attack on the exposed SSH interface.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Schneider-electric — Evlink Home Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-5313",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-5313",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-12T14:57:54.307091Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cybersecurity@se.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@se.com",
      "affectedData": [
        {
          "vendor": "Schneider Electric",
          "product": "EVlink Home Smart",
          "versions": [
            {
              "status": "affected",
              "version": "v2.0.4.1.2_131"
            },
            {
              "status": "affected",
              "version": "v2.0.3.8.2_128"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:schneider-electric:evlink_home_smart:2.0.4.1.2_131:*:*:*:*:*:*:*"
          ],
          "vendor": "schneider-electric",
          "product": "evlink_home_smart",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.4.1.2_131"
            },
            {
              "status": "affected",
              "version": "2.0.3.8.2_128"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-12T13:15:50.343",
  "references": [
    {
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-03.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-03.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@se.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH\ninterface over the product network interface. This does not allow to directly exploit the product or\nmake any unintended operation as the SSH interface access is protected by an authentication\nmechanism. Impacts are limited to port scanning and fingerprinting activities as well as attempts\nto perform a potential denial of service attack on the exposed SSH interface."
    },
    {
      "lang": "es",
      "value": "CWE-668: Existe exposición a la vulnerabilidad Resource Wrong Sphere que expone una interfaz SSH a través de la interfaz de red del producto. Esto no permite explotar directamente el producto ni realizar ninguna operación no deseada ya que el acceso a la interfaz SSH está protegido por un mecanismo de autenticación. Los impactos se limitan a actividades de escaneo de puertos y toma de huellas digitales, así como a intentos de realizar un posible ataque de denegación de servicio en la interfaz SSH expuesta."
    }
  ],
  "lastModified": "2026-06-17T08:15:40.993",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:evlink_home_firmware:2.0.3.8.2_128:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B763346-0129-441A-9024-D2B425E38B18"
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:evlink_home_firmware:2.0.4.1.2_131:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0D983AB-A039-4006-B164-25EFBF6C07D0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:evlink_home:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7266ADD9-9F0F-4E95-9CB6-14550F920CBC"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cybersecurity@se.com"
}