CVE-2024-5056
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may...
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem.
- Record
CVE-2024-5056- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-552
- Updated
- 2026-11-02
EUVDEUVD-2024-46320
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem.
- Record
EUVD-2024-46320- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fm6m-fmh2-f72v
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may...
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem.
- Record
GHSA-fm6m-fmh2-f72v- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-552
- Updated
- 2026-11-02
NVD
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem.
- Record
CVE-2024-5056- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-552
- Updated
- 2026-11-02
Affected products
- schneider electric modicon m340
- schneider electric network module, modicon m340, ethernet tcp/ip bmxnoe0110
- schneider electric network module, modicon m340, modbus/tcp bmxnoe0100
- schneider-electric bmxnoe0100 firmware
- schneider-electric bmxnoe0110 firmware
- schneider-electric modicom m340
- schneider-electric modicom m340 firmware
- schneider-electric modicon m340 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-5056 is a medium vulnerability (CVSS 6.5) in Schneider Electric Modicon M340, published June 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. No source names a fixed version.