CVE-2024-41969

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full system access and/or DoS.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
WAGO	CC100 0751-9x01	>= 0.0.0, <= 4.5.10 (FW27)
WAGO	PFC100 G2 0750-811x-xxxx-xxxx	>= 0.0.0, <= 4.5.10 (FW27)
WAGO	PFC200 G2 750-821x-xxx-xxx	>= 0.0.0, <= 4.5.10 (FW27)
WAGO	TP600 0762-420x/8000-000x	>= 0.0.0, <= 4.5.10 (FW27)
WAGO	TP600 0762-430x/8000-000x	>= 0.0.0, <= 4.5.10 (FW27)
WAGO	TP600 0762-520x/8000-000x	>= 0.0.0, <= 4.5.10 (FW27)
WAGO	TP600 0762-530x/8000-000x	>= 0.0.0, <= 4.5.10 (FW27)
WAGO	TP600 0762-620x/8000-000x	>= 0.0.0, <= 4.5.10 (FW27)
WAGO	TP600 0762-630x/8000-000x	>= 0.0.0, <= 4.5.10 (FW27)
WAGO	Edge Controller 0752-8303/8000-0002	>= 0.0.0, <= 4.5.10 (FW27)
WAGO	PFC100 G1 0750-810x/xxxx-xxxx	>= 0.0.0, <= 3.10.10 (FW22 Patch 1)
WAGO	PFC200 G1 750-820x-xxx-xxx	>= 0.0.0, <= 3.10.10 (FW22 Patch 1)
WAGO	PFC200 G1 0750-820x/xxx-xxx	>= 0.0.0, <= 03.03.08 (80)
WAGO	PFC200 G2 0750-821x/xxx-xxx	>= 0.0.0, <= 04.04.03 (70)
WAGO	CC100 0751/9x01	>= 0.0.0, <= 04.03.03 (72)
WAGO	CC100 0751/9x01	>= 0.0.0, <= 04.04.03 (70)

References

https://cert.vde.com/en/advisories/VDE-2024-047

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-41979.8An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X CVE-2024-419705.7A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.CVE-2024-419718.1A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.CVE-2024-419726.5A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privil CVE-2024-419738.1A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privil CVE-2024-419747.1A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources whic CVE-2024-419755.3An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual a CVE-2024-419768.8A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM CVE-2024-419778.0A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM CVE-2024-419786.5A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM CVE-2024-419798.0A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=CVE-2024-41982.7Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenti