PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-5681 Schneider Electric CVE debrief

CVE-2024-5681 is a high-severity vulnerability in Schneider Electric's EcoStruxure™ Foxboro DCS Core Control Services, published on July 9, 2024. The flaw stems from improper input validation (CWE-20) in the Foxboro.sys driver, enabling a local attacker to craft malicious IOCTL calls that can trigger denial-of-service, privilege escalation, or potentially kernel-level code execution. The attack requires local user access but carries significant impact given the industrial control system context. Affected versions span from 9.5 through 9.8. Schneider Electric has released patch HF97872598 to address this vulnerability.

Vendor
Schneider Electric
Product
EcoStruxureTM Foxboro DCS Core Control Services
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-07-09
Original CVE updated
2024-07-09
Advisory published
2024-07-09
Advisory updated
2024-07-09

Who should care

Organizations operating Schneider Electric EcoStruxure™ Foxboro DCS Core Control Services versions 9.5–9.8 in industrial process control environments, particularly in critical infrastructure sectors such as energy, water, chemical manufacturing, and oil & gas where Foxboro DCS platforms are deployed.

Technical summary

The vulnerability resides in the Foxboro.sys kernel driver component of EcoStruxure™ Foxboro DCS Core Control Services. Insufficient validation of input parameters to IOCTL handlers allows a locally authenticated user to send crafted requests that can corrupt kernel memory structures. This can result in system crashes (DoS), elevation from user to SYSTEM or kernel privileges, or arbitrary code execution in kernel context. The attack surface is limited to local access, but the impact is severe due to kernel-level compromise potential in critical infrastructure environments.

Defensive priority

HIGH

Recommended defensive actions

  • Apply Schneider Electric patch HF97872598 for affected versions 9.5–9.8 of EcoStruxure™ Foxboro DCS Core Control Services
  • Contact Schneider Electric Process Automation Global Customer Support or local Service Representative for patch download and installation assistance
  • Restrict physical access to EcoStruxure™ Foxboro DCS workstations to authorized personnel only
  • Implement strong password policies to prevent unauthorized remote access to affected systems
  • Subscribe to Schneider Electric's security notification service for future vulnerability alerts
  • Monitor for anomalous local process activity or unexpected IOCTL calls to the Foxboro.sys driver
  • Review and apply CISA ICS recommended practices for defense-in-depth strategies
  • resourceLinkAnnotations:ref-4,ref-5,ref-6,ref-7,ref-9

Evidence notes

CVE published 2024-07-09; CISA ICS advisory ICSA-24-345-02 issued same date; Schneider Electric security notice SEVD-2024-191-02 confirms patch availability. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields score 7.8.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-5681 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-5681

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-5681 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-5681

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-345-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.se.com/us/en/download/document/7EN52-0390/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.