CVE-2024-37037 Schneider Electric CVE debrief

Who should care

OT/ICS operators, control engineers, and administrators responsible for Schneider Electric Sage 1410, 1430, 1450, 2400, 3030 Magnum, or 4400 devices, especially where the device web interface is enabled and accessible to authenticated users.

Technical summary

CISA’s CSAF advisory ICSA-25-107-02 and Schneider Electric’s Security and Safety Notice SEVD-2024-163-05 describe a CWE-22 path traversal flaw in Sage Series devices. Affected products include Sage 1410, 1430, 1450, 2400, 3030 Magnum, and 4400 versions C3414-500-S02K5_P8 and prior. The issue requires authentication and access to the device web interface; a crafted HTTP request can corrupt files and affect functionality. The supplied CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (8.1 High).

Defensive priority

High. Prioritize firmware upgrade to C3414-500-S02K5_P9 for affected Sage devices, and reduce exposure of the web interface until remediation is complete.

Recommended defensive actions

• Inventory Sage RTU deployments and identify any devices running versions C3414-500-S02K5_P8 or earlier.
• Upgrade affected devices to firmware C3414-500-S02K5_P9, which Schneider Electric lists as the fix.
• Restrict access to the device web interface to only trusted administrative users and networks.
• Review and tighten account access controls for any users who can authenticate to the web interface.
• Apply CISA industrial control system recommended practices to support segmentation, access control, and defense in depth.
• Validate operational recovery procedures so file corruption on an affected device can be addressed quickly if needed.

Evidence notes

All findings are taken from the supplied CISA CSAF advisory metadata and the referenced Schneider Electric/CISA official links. The advisory’s revision history shows an original release on 2024-06-11, mitigation language added the same day, and a direct remediation link added on 2024-07-09. No KEV listing was supplied in the provided enrichment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.