CVE-2024-11425 Overview
CVE-2024-11425 is a high-severity denial-of-service vulnerability rooted in an incorrect buffer size calculation [CWE-131]. An unauthenticated remote attacker can send a crafted HTTPS packet to the embedded webserver and cause the affected product to enter a denial-of-service state. The flaw is exposed over the network and requires no privileges or user interaction, making it reachable by any actor who can deliver HTTPS traffic to the device. Schneider Electric documented the issue in security notice SEVD-2025-014-01. Because the impact targets availability of an industrial product, exploitation can interrupt operational processes that depend on the device's webserver interface.
Critical Impact
An unauthenticated attacker can remotely trigger denial-of-service against the affected webserver by sending a single crafted HTTPS packet, disrupting availability of the product.
Affected Products
- Schneider Electric product disclosed in advisory SEVD-2025-014-01 (refer to the vendor advisory for exact model and firmware ranges)
- Devices exposing the affected HTTPS webserver interface
- Deployments where the management webserver is reachable from untrusted networks
Discovery Timeline
- 2025-01-17 - CVE-2024-11425 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-11425
Vulnerability Analysis
The vulnerability is classified as Incorrect Calculation of Buffer Size [CWE-131]. The webserver computes the size of a buffer used while parsing or processing an incoming HTTPS request, but the calculation does not correctly account for all input conditions. When an attacker delivers a crafted HTTPS packet, the miscalculated buffer leads to a memory handling fault that crashes or hangs the webserver process.
The Common Weakness Enumeration entry CWE-131 covers cases where a developer miscomputes the number of bytes needed for a buffer, often through off-by-one errors, missing accounting for terminators, or incorrect arithmetic on attacker-controlled length fields. In this CVE, the resulting condition affects availability only — there is no documented impact to confidentiality or integrity.
The attack vector is network-based and requires no authentication or user interaction. The EPSS probability is 0.605%.
Root Cause
The root cause is faulty arithmetic when sizing a buffer used to handle HTTPS request data. The webserver trusts a length value or computes a size without validating that the result fits the destination buffer or processing logic. When the malformed packet is parsed, the runtime encounters an invalid memory operation and the service becomes unavailable.
Attack Vector
An unauthenticated attacker who can reach TCP port 443 on the affected device sends a specially crafted HTTPS request. The malformed structure triggers the buffer size miscalculation during request handling. The webserver process terminates or stops responding, denying management access and any process that depends on the HTTPS service. No verified public exploit or proof-of-concept is available at the time of writing.
No verified exploit code is publicly available. Refer to the Schneider Electric Security Notice SEVD-2025-014-01 for vendor-supplied technical details.
Detection Methods for CVE-2024-11425
Indicators of Compromise
- Unexpected restarts, crashes, or unresponsiveness of the device's HTTPS management webserver
- Inbound HTTPS requests from untrusted sources with malformed TLS records or anomalous content-length fields
- Loss of availability for the management interface while other device functions remain operational
Detection Strategies
- Monitor device health and webserver uptime, alerting on repeated webserver restarts or process termination events
- Inspect network telemetry for HTTPS sessions to operational technology assets originating from outside expected administrative subnets
- Correlate webserver outages with concurrent inbound HTTPS traffic spikes or malformed request patterns at perimeter devices
Monitoring Recommendations
- Collect syslog, SNMP, and device diagnostic logs centrally to detect service crashes
- Apply network intrusion detection signatures for malformed TLS or HTTP requests aimed at industrial assets
- Track baseline HTTPS traffic to management interfaces and alert on deviations in source IP, volume, or session duration
How to Mitigate CVE-2024-11425
Immediate Actions Required
- Review the Schneider Electric Security Notice SEVD-2025-014-01 and identify affected firmware versions in your environment
- Apply the vendor-supplied firmware update as soon as a maintenance window allows
- Restrict network access to the device's HTTPS webserver to a dedicated administrative network or jump host
Patch Information
Schneider Electric provides remediation and mitigation guidance in advisory SEVD-2025-014-01. Consult the advisory for fixed firmware versions, mitigation steps, and product-specific instructions. The advisory PDF is available at the Schneider Electric Security Notice SEVD-2025-014-01.
Workarounds
- Disable the HTTPS webserver on the device if it is not required for operations
- Place affected devices behind a firewall that permits HTTPS only from authorized engineering workstations
- Segment operational technology networks from corporate and internet-facing networks to limit reachability
- Enforce VPN access for any remote management of affected products
# Example firewall rule to restrict HTTPS access to a Schneider Electric device
# Replace <DEVICE_IP> and <ADMIN_SUBNET> with your environment values
iptables -A FORWARD -p tcp -s <ADMIN_SUBNET> -d <DEVICE_IP> --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d <DEVICE_IP> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
