PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-5680 Schneider Electric CVE debrief

CVE-2024-5680 is a high-severity local denial-of-service vulnerability in Schneider Electric's EcoStruxure™ Foxboro DCS Core Control Services, published on 2024-07-09. The flaw stems from CWE-129 (Improper Validation of Array Index) in the Foxboro.sys driver, where a malicious actor with local user access can trigger a DoS condition by crafting a script or program using an IOCTL call. The vulnerability affects versions 9.5 through 9.8 of the Core Control Services. Schneider Electric has released patch HF97872598 to address this issue. The CVSS v3.1 score of 7.1 reflects high impacts to integrity and availability, though the attack requires local access and low privileges. CISA has issued advisory ICSA-24-345-02 documenting this vulnerability.

Vendor
Schneider Electric
Product
EcoStruxureTM Foxboro DCS Core Control Services
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-07-09
Original CVE updated
2024-07-09
Advisory published
2024-07-09
Advisory updated
2024-07-09

Who should care

Organizations operating Schneider Electric EcoStruxure Foxboro DCS Core Control Services in industrial environments, particularly those in critical infrastructure sectors. System administrators responsible for OT/ICS security, plant engineers, and cybersecurity teams managing distributed control systems should prioritize this patch due to the high availability impact and relatively low barrier to exploitation for authenticated local users.

Technical summary

The vulnerability exists in the Foxboro.sys driver component of EcoStruxure™ Foxboro DCS Core Control Services. An improper validation of array index (CWE-129) allows a locally authenticated attacker to cause denial-of-service by sending crafted IOCTL calls. The attack requires local user access but no user interaction. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H indicates local attack vector, low attack complexity, low privileges required, no user interaction, with high impact to integrity and availability but no confidentiality impact. Affected versions span from 9.5 to 9.8. The vendor fix requires system restart after patch application.

Defensive priority

HIGH

Recommended defensive actions

  • Apply patch HF97872598 for EcoStruxure Foxboro DCS Core Control Services versions 9.5 through 9.8 by contacting Schneider Electric Process Automation Global Customer Support Center
  • Ensure EcoStruxure Foxboro DCS workstations are installed in physically secure locations to prevent unauthorized local access
  • Implement strong password protections to prevent remote access by unauthorized personnel
  • Subscribe to Schneider Electric's security notification service for future vulnerability alerts
  • Review CISA ICS recommended practices for defense-in-depth strategies for industrial control systems

Evidence notes

Vulnerability disclosed via CISA CSAF advisory ICSA-24-345-02 on 2024-07-09. Schneider Electric published security notice SEVD-2024-191-02. Patch HF97872598 available for affected versions 9.5-9.8.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-5680 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-5680

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-5680 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-5680

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-345-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.se.com/us/en/download/document/7EN52-0390/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.