CVE-2024-11497 - Vulnerability Details - OpenCVE

An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00154.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-34375	An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2024-070

History

Tue, 14 Jan 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 14 Jan 2025 14:00:00 +0000

Type	Values Removed	Values Added
Description		An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access.
Title		Phoenix Contact: CHARX-SEC3xxx Charge controllers vulnerable to privilege escalation
Weaknesses		CWE-732
References		https://cert.vde.com/en/advisories/VDE-2024-070
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2025-01-14T13:55:57.890Z

Updated: 2025-01-14T14:17:44.111Z

Reserved: 2024-11-20T10:45:49.608Z

Link: CVE-2024-11497

Vulnrichment

Updated: 2025-01-14T14:17:38.221Z

NVD

Status : Received

Published: 2025-01-14T14:15:27.720

Modified: 2025-01-14T14:15:27.720

Link: CVE-2024-11497

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-11497", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2024-11-20T10:45:49.608Z", "datePublished": "2025-01-14T13:55:57.890Z", "dateUpdated": "2025-01-14T14:17:44.111Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CHARX SEC-3000", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "1.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CHARX SEC-3050", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "1.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CHARX SEC-3100", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "1.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CHARX SEC-3150", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "1.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Tien Phan"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Richard Jaletzki"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access.</span><br>"}], "value": "An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-01-14T13:55:57.890Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2024-070"}], "source": {"advisory": "VDE-2024-070", "defect": ["CERT@VDE#641697"], "discovery": "UNKNOWN"}, "title": "Phoenix Contact: CHARX-SEC3xxx Charge controllers vulnerable to privilege escalation", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-14T14:17:32.681825Z", "id": "CVE-2024-11497", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-14T14:17:44.111Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-11497", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-14T14:17:32.681825Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-14T14:17:38.221Z"}}], "cna": {"title": "Phoenix Contact: CHARX-SEC3xxx Charge controllers vulnerable to privilege escalation", "source": {"defect": ["CERT@VDE#641697"], "advisory": "VDE-2024-070", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Tien Phan"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Richard Jaletzki"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PHOENIX CONTACT", "product": "CHARX SEC-3000", "versions": [{"status": "affected", "version": "0", "lessThan": "1.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "PHOENIX CONTACT", "product": "CHARX SEC-3050", "versions": [{"status": "affected", "version": "0", "lessThan": "1.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "PHOENIX CONTACT", "product": "CHARX SEC-3100", "versions": [{"status": "affected", "version": "0", "lessThan": "1.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "PHOENIX CONTACT", "product": "CHARX SEC-3150", "versions": [{"status": "affected", "version": "0", "lessThan": "1.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2024-070"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-01-14T13:55:57.890Z"}}}, "cveMetadata": {"cveId": "CVE-2024-11497", "state": "PUBLISHED", "dateUpdated": "2025-01-14T14:17:44.111Z", "dateReserved": "2024-11-20T10:45:49.608Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2025-01-14T13:55:57.890Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}