CVE-2024-37040 Schneider Electric CVE debrief

Who should care

OT/ICS operators, plant engineers, and administrators responsible for Schneider Electric Sage RTU deployments, especially where the device web interface is reachable.

Technical summary

The issue is described as CWE-120, a classic buffer overflow caused by copying input without checking size. Per the CISA CSAF advisory, the affected products are Schneider Electric Sage 1410, 1430, 1450, 2400, 3030 Magnum, and 4400 versions C3414-500-S02K5_P8 and prior. The reported impact is that a user with web interface access can trigger a device fault by sending a malformed HTTP request. The published CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, with a base score of 5.4.

Defensive priority

Medium; prioritize updating exposed Sage RTU web interfaces to the fixed firmware version and limit access until patching is complete.

Recommended defensive actions

• Upgrade affected Sage RTU devices from C3414-500-S02K5_P8 and earlier to firmware C3414-500-S02K5_P9.
• Restrict access to the device web interface to trusted management networks and authorized users only.
• Verify which Sage 1410/1430/1450/2400/3030 Magnum/4400 devices are affected in your environment and schedule remediation.
• Monitor for unexpected device faults or service interruptions that could indicate malformed-request triggering.
• Follow Schneider Electric’s remediation guidance and CISA ICS recommended practices for defensive segmentation and access control.

Evidence notes

The source corpus identifies CVE-2024-37040 in CISA CSAF advisory ICSA-25-107-02 (Schneider Electric Sage Series). Revision history shows the original release on 2024-06-11, mitigation information added the same day, and a 2024-07-09 update that added a direct remediation link. The affected versions are listed as C3414-500-S02K5_P8 and prior, and the remediation lists firmware C3414-500-S02K5_P9 as the fixed release. The advisory describes the impact as a device fault triggered through a malformed HTTP request sent via the web interface.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.