CVE-2024-37037: Sage RTU Firmware Path Traversal Flaw

CVE-2024-37037 Overview

CVE-2024-37037 is a path traversal vulnerability [CWE-22] affecting Schneider Electric Sage Remote Terminal Unit (RTU) firmware. The flaw exists in the device's web interface and allows an authenticated user to corrupt files by sending a crafted HTTP request. Successful exploitation impacts device integrity and availability, which is significant for industrial control systems (ICS) deployed in critical infrastructure environments such as electric utilities.

Schneider Electric published advisory SEVD-2024-163-05 addressing the issue across multiple Sage RTU hardware platforms. The vulnerability requires low-privilege authenticated access over the network but does not require user interaction.

Critical Impact
An authenticated attacker on the network can corrupt files on the RTU through path traversal, disrupting operational technology functionality on Sage 1410, 1430, 1450, 2400, 3030 Magnum, and 4400 devices.

Affected Products

Schneider Electric Sage RTU Firmware
Schneider Electric Sage 1410, Sage 1430, Sage 1450
Schneider Electric Sage 2400, Sage 3030 Magnum, Sage 4400

Discovery Timeline

2024-06-12 - CVE-2024-37037 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37037

Vulnerability Analysis

The vulnerability stems from improper limitation of a pathname to a restricted directory in the Sage RTU web interface. When the device processes crafted HTTP requests, it fails to correctly validate or normalize file path parameters. An authenticated attacker can supply directory traversal sequences to reference files outside the intended working directory.

Exploitation allows the attacker to corrupt files stored on the device. Because the Sage RTU serves substation automation and telemetry functions, file corruption can disrupt monitoring, control logic, and communications with SCADA masters. The impact profile is limited to integrity and availability; confidentiality is not directly affected according to the CVSS vector.

The attack surface is the HTTP management interface exposed to authenticated users. In many industrial deployments, this interface may be reachable from engineering workstations, jump hosts, or flat operational networks where lateral movement is feasible.

Root Cause

The root cause is insufficient input validation on file path parameters accepted by the web interface. The firmware does not canonicalize user-supplied paths or reject traversal sequences such as ../ before performing file operations. This allows references outside the intended directory scope during authenticated request handling.

Attack Vector

An attacker first obtains valid low-privilege credentials for the RTU web interface, either through credential theft, default accounts, or lateral movement inside the operational network. The attacker then sends a crafted HTTP request containing traversal sequences that reference files outside the permitted directory. The RTU processes the request and modifies or corrupts the referenced file, degrading device functionality.

No verified proof-of-concept code is publicly available. Technical details are limited to the vendor advisory SEVD-2024-163-05.

Detection Methods for CVE-2024-37037

Indicators of Compromise

HTTP requests to the Sage RTU web interface containing traversal sequences such as ../, ..%2f, or encoded variants in URL paths or parameters.
Unexpected file modifications, missing configuration files, or device restarts on Sage RTU units following authenticated web sessions.
Authentication events from unusual source addresses or outside maintenance windows preceding device malfunction.

Detection Strategies

Inspect network traffic to RTU management interfaces for HTTP requests that include directory traversal patterns in URIs or POST bodies.
Correlate authentication events on RTU devices with subsequent operational anomalies reported by SCADA historians.
Baseline normal engineering workflows and alert on deviations in HTTP method, path, or parameter structure sent to Sage RTU web endpoints.

Monitoring Recommendations

Enable and centrally forward Sage RTU audit logs to a security data lake for retention and correlation with network telemetry.
Monitor operational technology (OT) network segments with an ICS-aware intrusion detection system tuned for Schneider Electric protocols.
Track configuration integrity of RTU firmware and files using periodic hash comparisons against a known-good baseline.

How to Mitigate CVE-2024-37037

Immediate Actions Required

Apply the firmware update referenced in Schneider Electric advisory SEVD-2024-163-05 to all affected Sage RTU models.
Restrict access to the RTU web interface to a dedicated engineering VLAN and jump host, and block it from general corporate networks.
Rotate credentials on Sage RTU devices and enforce unique, strong passwords for each account.
Audit existing accounts on affected RTUs and remove any unused or shared credentials.

Patch Information

Schneider Electric released a remediation as documented in SEVD-2024-163-05. Operators of Sage 1410, 1430, 1450, 2400, 3030 Magnum, and 4400 devices should follow the vendor guidance for the corrected firmware version and validated upgrade procedure.

Workarounds

Place Sage RTU devices behind a firewall that restricts HTTP access to explicitly authorized engineering hosts.
Disable the web interface on RTUs that do not require it for daily operations, using serial or dedicated maintenance channels instead.
Implement network segmentation between IT and OT environments in line with IEC 62443 zones and conduits guidance.
Enable multi-factor authentication on any jump host used to reach RTU management interfaces.

bash

# Example firewall rule limiting RTU web access to an engineering host
# Replace addresses with values that match the local environment
iptables -A FORWARD -s 10.10.20.5/32 -d 10.50.0.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.50.0.0/24 -p tcp --dport 443 -j DROP