PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-5679 Schneider Electric CVE debrief

CVE-2024-5679 is a high-severity (CVSS 7.1) out-of-bounds write vulnerability (CWE-787) in the Foxboro.sys driver of Schneider Electric's EcoStruxure™ Foxboro DCS Core Control Services. Published on July 9, 2024, this vulnerability affects versions 9.5 through 9.8 of the distributed control system software used in industrial process automation environments. The flaw requires local user access to exploit, where a malicious actor can craft a script or program using an IOCTL call to trigger the vulnerability, potentially causing local denial-of-service conditions or kernel memory leaks. The attack vector is local with low attack complexity and low privileges required, though the impact to integrity and availability is high. Schneider Electric has released patch HF97872598 to address this vulnerability for affected versions. Given the industrial control system context, organizations should prioritize patching while implementing compensating controls including physical security of workstations and strict access controls to prevent unauthorized local access.

Vendor
Schneider Electric
Product
EcoStruxureTM Foxboro DCS Core Control Services
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-07-09
Original CVE updated
2024-07-09
Advisory published
2024-07-09
Advisory updated
2024-07-09

Who should care

Organizations operating Schneider Electric EcoStruxure Foxboro DCS Core Control Services in industrial process control environments, particularly in critical infrastructure sectors such as energy, water, chemical manufacturing, and oil & gas. System administrators, OT security teams, and plant engineers responsible for maintaining DCS workstation security should prioritize this patch. Organizations with regulatory compliance requirements for industrial control system security (NERC CIP, IEC 62443) should assess this vulnerability against their risk management frameworks.

Technical summary

The vulnerability exists in the Foxboro.sys kernel driver component of EcoStruxure™ Foxboro DCS Core Control Services. An out-of-bounds write (CWE-787) can be triggered through crafted IOCTL calls, enabling a locally authenticated user to corrupt kernel memory. This can result in denial-of-service conditions or kernel memory leaks. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates local attack vector with low complexity, requiring low privileges but yielding high impact to system integrity and availability. No confidentiality impact is rated. The vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog as of the advisory date.

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor patch HF97872598 for EcoStruxure Foxboro DCS Core Control Services versions 9.5-9.8 by contacting Schneider Electric Process Automation Global Customer Support Center
  • Ensure EcoStruxure Foxboro DCS workstations are installed in physically secure locations to prevent unauthorized local access
  • Implement strong password protections and access controls to prevent remote compromise that could lead to local access
  • Subscribe to Schneider Electric's security notification service for future vulnerability alerts
  • Review and apply CISA ICS recommended practices for defense-in-depth strategies in industrial control environments

Evidence notes

CVE description and CVSS vector confirm local attack vector (AV:L) with low complexity (AC:L) and low privileges (PR:L), but high impact to integrity (I:H) and availability (A:H). Affected product versions 9.5-9.8 confirmed through CSAF product tree. Patch HF97872598 availability confirmed through vendor remediation guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-5679 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-5679

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-5679 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-5679

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-345-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.se.com/us/en/download/document/7EN52-0390/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.