CVE-2024-10497: Authorization Bypass Vulnerability

CVE-2024-10497 Overview

CVE-2024-10497 is an authorization bypass vulnerability tracked as CWE-639: Authorization Bypass Through User-Controlled Key. The flaw affects a Schneider Electric device that exposes an HTTPS management interface. An authenticated attacker with low privileges can send modified HTTPS requests to alter values outside the scope of their assigned role. Successful exploitation results in elevation of privileges on the target device.

Schneider Electric published security notice SEVD-2025-014-08 documenting the issue and remediation guidance.

Critical Impact
An authenticated low-privilege user can elevate privileges over the network by tampering with user-controlled identifiers in HTTPS requests, compromising confidentiality, integrity, and availability of the affected device.

Affected Products

Schneider Electric product referenced in advisory SEVD-2025-014-08
Specific model and firmware versions listed in the Schneider Electric Security Notice
Deployments exposing the HTTPS management interface to reachable networks

Discovery Timeline

2025-01-17 - CVE-2024-10497 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10497

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) class weakness classified under CWE-639. The device's HTTPS interface accepts identifiers or key values supplied by the client and uses them to reference protected resources or configuration entries. The application authenticates the requester but does not re-verify that the requester is authorized to act on the referenced object.

As a result, a legitimate low-privilege user can submit HTTPS requests referencing objects, users, or configuration fields that belong to higher-privilege scopes. The device processes the request and applies changes outside the caller's role boundary. The attacker gains elevated privileges without exploiting memory corruption or authentication logic.

The EPSS score is 0.548% with a percentile of 42.98, indicating limited observed exploitation activity at the time of publication.

Root Cause

The root cause is missing object-level authorization on server-side handlers of the HTTPS management interface. The application trusts the identifier supplied in the request body or URL and does not compare it against the session principal's permissions. This mirrors the pattern documented under CWE-639: Authorization Bypass Through User-Controlled Key.

Attack Vector

The attack requires network reachability to the device's HTTPS interface and valid low-privilege credentials. The attacker authenticates normally, then intercepts or crafts an HTTPS request that references a resource identifier belonging to an administrative user or a protected configuration key. The device processes the request without checking authorization, applying the modification with the effective rights of the referenced object.

Exploitation does not require user interaction or elevated privileges. See the Schneider Electric Security Notice for vendor-specific request paths and remediation.

Detection Methods for CVE-2024-10497

Indicators of Compromise

Unexpected changes to administrator accounts, role assignments, or privileged configuration entries on the affected device
HTTPS requests from low-privilege sessions that reference object identifiers outside the caller's normal scope
Audit log entries showing privilege changes without a corresponding administrative session
New or modified user accounts created shortly after low-privilege authentication events

Detection Strategies

Enable and centralize device audit logging, then alert on privilege modifications correlated with non-administrative session identifiers
Inspect HTTPS traffic to the management interface for parameter tampering patterns targeting user or role identifiers
Baseline normal API usage per role and flag deviations where low-privilege accounts issue requests targeting privileged object IDs

Monitoring Recommendations

Forward device syslog and web-server access logs to a SIEM for correlation with authentication events
Monitor for repeated HTTPS requests to configuration endpoints from a single authenticated session
Track failed and successful authorization decisions separately to identify probing behavior
Alert on out-of-hours configuration changes to the affected device

How to Mitigate CVE-2024-10497

Immediate Actions Required

Apply the firmware update referenced in Schneider Electric advisory SEVD-2025-014-08 as soon as it is available for your model
Restrict network access to the device's HTTPS management interface to trusted administrative networks only
Rotate credentials for all device accounts and remove unused low-privilege accounts
Review recent audit logs for unauthorized privilege changes and revert any unexpected modifications

Patch Information

Refer to the Schneider Electric Security Notice SEVD-2025-014-08 for the list of fixed firmware versions and applicable product references. Customers should validate patches in a staging environment before deploying to production operational technology assets.

Workarounds

Place the device behind a firewall or jump host that enforces source-IP allowlists for the HTTPS interface
Disable or limit remote management access where operationally feasible
Enforce least privilege by removing unnecessary user accounts and reviewing role assignments
Enable strict logging and monitoring on the management interface until the patch is deployed

bash

# Example firewall restriction limiting HTTPS management access to a trusted subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP