CVE-2024-49399 Elvaco CVE debrief

Who should care

Organizations operating Elvaco CMe3100 M-Bus Metering Gateways in utility, building automation, or industrial metering environments should prioritize this update. System integrators and operators of critical infrastructure relying on M-Bus gateway devices for energy consumption monitoring should assess exposure and apply mitigations.

Technical summary

The Elvaco M-Bus Metering Gateway CMe3100 version 1.12.1 contains an authentication bypass vulnerability that allows an attacker to execute commands without providing a password. This unauthenticated access may enable an attacker to leak information from the device. The vulnerability has a CVSS 3.1 score of 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network exploitable, low attack complexity, no privileges required, no user interaction, and high impact to confidentiality with no integrity or availability impact. Elvaco released firmware version 1.13.3 on or before November 14, 2024, which includes security enhancements addressing this vulnerability and CVE-2024-49397. The vendor notes that additional vulnerabilities requiring authentication remain and will be addressed in a subsequent update.

Defensive priority

HIGH

Recommended defensive actions

• Upgrade Elvaco CMe3100 firmware to version 1.13.3 or later to address CVE-2024-49399
• Ensure CMe3100 devices are deployed on private or closed networks and not exposed to untrusted or internet-facing networks
• Contact Elvaco customer support for additional information regarding affected versions and upgrade procedures
• Monitor for additional security updates from Elvaco as the vendor indicates further updates are planned to address remaining vulnerabilities
• Apply network segmentation and access controls to limit exposure of industrial control system devices per CISA ICS recommended practices

Evidence notes

CISA ICS advisory ICSA-24-291-01 (Update A) published October 17, 2024, modified November 14, 2024. CVSS 3.1 score 7.5 (HIGH). Affected product confirmed as Elvaco CMe3100: 1.12.1. Vendor fix available in firmware 1.13.3 per remediation details in CSAF source.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.