PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-8518 Schneider Electric CVE debrief

An Improper Input Validation vulnerability in Schneider Electric Zelio Soft 2 allows application crashes via specially crafted project files. The vulnerability requires local access and user interaction, with no confidentiality or integrity impact—only availability is affected at a low severity level.

Vendor
Schneider Electric
Product
Zelio Soft 2
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2024-10-10
Original CVE updated
2024-10-10
Advisory published
2024-10-10
Advisory updated
2024-10-10

Who should care

Engineering workstations running Zelio Soft 2 for PLC programming and maintenance; OT security teams managing Schneider Electric environments; asset owners relying on Zelio Logic smart relays for industrial control applications.

Technical summary

The vulnerability stems from insufficient validation of project file contents in Zelio Soft 2 versions prior to 5.4.2.2. A malformed project file can trigger an application crash when loaded. The attack vector is local, requiring an attacker to deliver a crafted file and convince a user to open it. No privileges are required, but user interaction is necessary. The impact is limited to denial of service (application availability) with no confidentiality or integrity compromise.

Defensive priority

low

Recommended defensive actions

  • Update Zelio Soft 2 to version 5.4.2.2 or later through the Schneider Electric Software Update (SESU) application or via the vendor download portal.
  • Restrict user permissions to prevent unauthorized modification or replacement of project files.
  • Implement application whitelisting and integrity monitoring for Zelio Soft 2 installation and project directories.
  • Train users to verify project file sources and avoid opening files from untrusted origins.
  • Monitor for unexpected application crashes as potential indicators of exploitation attempts.

Evidence notes

CISA CSAF advisory ICSA-24-284-14 published 2024-10-10 confirms the vulnerability and remediation path. CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L sourced from official advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-8518 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-8518

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-8518 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-8518

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-284-14.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-14

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.