CVE-2024-8935: Authentication Bypass Vulnerability

CVE-2024-8935 Overview

CVE-2024-8935 is an authentication bypass vulnerability [CWE-290] affecting Schneider Electric controllers during communication with engineering workstations. The flaw stems from the inherent limitation of the Diffie-Hellman key exchange algorithm, which does not protect against Man-in-the-Middle (MITM) attacks. An attacker positioned between the controller and the engineering workstation can intercept session establishment by a valid user. Successful exploitation results in denial of service and loss of confidentiality and integrity on the controller. Schneider Electric disclosed the issue in security advisory SEVD-2024-317-02.

Critical Impact
A network-positioned attacker can hijack engineering sessions to compromise controller confidentiality, integrity, and availability in operational technology environments.

Affected Products

Schneider Electric controllers as listed in advisory SEVD-2024-317-02
Engineering workstation software performing Diffie-Hellman session establishment with affected controllers
Industrial control system deployments relying on unauthenticated key exchange between controller and workstation

Discovery Timeline

2024-11-13 - CVE-2024-8935 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-8935

Vulnerability Analysis

The vulnerability resides in the session establishment process between the Schneider Electric controller and the engineering workstation. The two endpoints negotiate a shared key using the Diffie-Hellman (DH) algorithm. Standard Diffie-Hellman provides confidentiality for the resulting key but does not authenticate the peers exchanging public parameters.

An attacker with network access between the controller and the workstation can intercept the DH handshake. The attacker negotiates one key with the workstation and a separate key with the controller. Both endpoints believe they share a session with the legitimate peer, while the attacker decrypts, reads, modifies, or drops traffic in transit.

This breaks both confidentiality and integrity of engineering commands. The attacker can issue arbitrary controller operations, alter logic downloads, or disrupt the session entirely, causing denial of service on the targeted controller.

Root Cause

The root cause is the absence of peer authentication in the Diffie-Hellman exchange. Without certificate pinning, pre-shared keys, or signed DH parameters, neither endpoint can verify the identity of the party on the other end of the negotiation. The protocol design assumes a trusted network path, which does not hold in real-world OT networks reachable by an attacker.

Attack Vector

Exploitation requires the attacker to occupy a network position between the controller and the engineering workstation while a valid user is initiating a session. The attack is network-based with high complexity, since timing the interception during a legitimate session establishment is required. Once positioned, the attacker relays and rewrites DH handshake messages to establish independent sessions with each endpoint. The vulnerability has an EPSS score of 0.483% (37.7 percentile) and no public exploit is currently available.

See the Schneider Electric Security Advisory SEVD-2024-317-02 for the full list of affected products and technical details.

Detection Methods for CVE-2024-8935

Indicators of Compromise

Unexpected ARP table changes or duplicate MAC addresses on OT network segments connecting controllers to engineering workstations
Engineering session establishment events originating from unexpected source addresses or at unusual times
TLS or DH handshake parameter mismatches recorded by network monitoring sensors
Unscheduled controller configuration changes, logic downloads, or operating mode transitions

Detection Strategies

Deploy passive network monitoring on OT segments to baseline normal engineering-workstation-to-controller traffic and alert on deviations
Correlate controller audit logs with workstation session logs to identify sessions present on one side but not the other
Monitor for ARP spoofing, rogue DHCP responses, and unauthorized hosts on the engineering VLAN

Monitoring Recommendations

Forward controller and engineering workstation logs to a centralized SIEM with long-term retention for forensic review
Enable alerting on any modification of project files, controller logic, or runtime parameters outside change-control windows
Continuously inventory devices on OT subnets and alert on new or unexpected MAC and IP pairings

How to Mitigate CVE-2024-8935

Immediate Actions Required

Review Schneider Electric advisory SEVD-2024-317-02 to identify affected controller models and firmware versions in your environment
Restrict engineering workstation connectivity to controllers using dedicated, segmented, and monitored network paths
Limit engineering session establishment to maintenance windows with active operator supervision
Disable or block remote access paths that allow attackers to reach the engineering communication channel

Patch Information

Refer to the Schneider Electric Security Advisory SEVD-2024-317-02 for firmware updates, fixed versions, and remediation guidance specific to each affected controller family. Apply vendor-supplied firmware as soon as operational change windows permit.

Workarounds

Place affected controllers behind a firewall that restricts engineering protocol traffic to known workstation IP addresses
Use a VPN or IPsec tunnel with mutual authentication to carry engineering traffic between workstation and controller subnets
Enable port security, 802.1X, and dynamic ARP inspection on switches that connect engineering workstations and controllers
Physically secure the engineering workstation and controller network ports to prevent unauthorized device insertion

bash

# Example: restrict engineering protocol to authorized workstation only
iptables -A FORWARD -p tcp -s 10.10.20.15 -d 10.10.30.0/24 --dport 502 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.10.30.0/24 --dport 502 -j DROP