CVE-2024-49397 Elvaco CVE debrief

Who should care

Organizations operating Elvaco CMe3100 M-Bus Metering Gateways in utility, building automation, or industrial metering environments; OT security teams managing M-Bus infrastructure; and critical infrastructure operators relying on secure gateway communications for energy or water metering data collection.

Technical summary

The Elvaco CMe3100 M-Bus Metering Gateway version 1.12.1 contains a stored cross-site scripting vulnerability that can be exploited without authentication. Successful exploitation allows an attacker to bypass authentication mechanisms and gain administrative control of the device. The attack complexity is rated as high per CVSS 3.1, indicating some conditions must be met for exploitation. The vulnerability has network attack vector with no privileges required. Elvaco addressed this specific authentication bypass risk in firmware version 1.13.3, released as a vendor fix. Additional vulnerabilities requiring authentication remain under active remediation by the vendor.

Defensive priority

critical

Recommended defensive actions

• Upgrade Elvaco CMe3100 firmware to version 1.13.3 or later to address the authentication bypass vulnerability
• Ensure CMe3100 devices are deployed on private or closed networks and not directly exposed to untrusted networks
• Review and apply CISA ICS recommended practices for securing industrial control systems
• Contact Elvaco customer support for additional information if running affected firmware versions
• Monitor for additional security updates from Elvaco as they continue addressing remaining authenticated vulnerabilities

Evidence notes

CISA ICS Advisory ICSA-24-291-01 (initial) and Update A (2024-11-14) document the XSS vulnerability enabling authentication bypass and admin account takeover. CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H confirms network attack vector with high confidentiality, integrity, and availability impact. Remediation details specify firmware 1.13.3 as the vendor fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.