CVE-2024-10575

Published Nov 13, 2024

Updated

CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected devices.

Affected Software

4 affected components

Schneider-electric Ecostruxure It Gateway=1.21.0.6

Schneider-electric Ecostruxure It Gateway=1.22.0.3

Schneider-electric Ecostruxure It Gateway=1.22.1.5

Schneider-electric Ecostruxure It Gateway=1.23.0.4

Remediation

Patch Available

https://download.schneider-electric.com/doc/SEVD-2024-317-04/SEVD-2024-317-04.pdf

Event History

Nov 13, 2024

CVE Published

via MITRE·04:35 AM

Data Sourced

via MITRE·04:35 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-10575?

CVE-2024-10575 has a high severity level due to the risk of unauthorized access affecting connected devices.

How do I fix CVE-2024-10575?

To fix CVE-2024-10575, disable the affected feature that allows bypassing authorization in Schneider Electric EcoStruxure IT Gateway.

Which versions of Schneider Electric EcoStruxure IT Gateway are affected by CVE-2024-10575?

CVE-2024-10575 affects Schneider Electric EcoStruxure IT Gateway versions 1.21.0.6, 1.22.0.3, 1.22.1.5, and 1.23.0.4.

What potential impact does CVE-2024-10575 have?

CVE-2024-10575 can result in unauthorized access to connected devices, leading to possible data breaches and operational disruptions.

How can organizations mitigate the risks of CVE-2024-10575?

Organizations can mitigate the risks of CVE-2024-10575 by applying available patches and ensuring proper authorization configurations are in place.