CVE-2024-39354

If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagItem can be exploited, allowing the attacker to remotely execute arbitrary code.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-312-02	US Government Resource
https://www.deltaww.com/en-US/Cybersecurity_Advisory	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:deltaww:diascreen:*:*:*:*:*:*:*:*

History

30 Jan 2025, 14:35

Type	Values Removed	Values Added
CPE		cpe:2.3:a:deltaww:diascreen::::::::
CWE		CWE-787
First Time		Deltaww diascreen Deltaww
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-24-312-02 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-24-312-02 - US Government Resource
References	~~() https://www.deltaww.com/en-US/Cybersecurity_Advisory -~~	() https://www.deltaww.com/en-US/Cybersecurity_Advisory - Vendor Advisory

12 Nov 2024, 13:55

Type	Values Removed	Values Added
Summary		(es) Si un atacante engaña a un usuario válido para que ejecute Delta Electronics DIAScreen con un archivo que contiene código malicioso, se puede explotar un desbordamiento de búfer basado en pila en CEtherIPTagItem, lo que permite al atacante ejecutar de forma remota código arbitrario.

11 Nov 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-11 15:15

Updated : 2025-01-30 14:35

NVD link : CVE-2024-39354

Mitre link : CVE-2024-39354

CVE.ORG link : CVE-2024-39354

JSON object : View

Products Affected

deltaww

diascreen

CWE

CWE-121

Stack-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2024-39354", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 8.4, "automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-11-11T15:15:05.243", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-312-02", "tags": ["US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.deltaww.com/en-US/Cybersecurity_Advisory", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-121"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagItem can be exploited, allowing the attacker to remotely execute arbitrary code."}, {"lang": "es", "value": "Si un atacante enga\u00f1a a un usuario v\u00e1lido para que ejecute Delta Electronics DIAScreen con un archivo que contiene c\u00f3digo malicioso, se puede explotar un desbordamiento de b\u00fafer basado en pila en CEtherIPTagItem, lo que permite al atacante ejecutar de forma remota c\u00f3digo arbitrario."}], "lastModified": "2025-01-30T14:35:18.047", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:diascreen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4130B745-1597-420D-A2B0-2B56F077E60C", "versionEndExcluding": "1.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}