Exploitation: No known public exploits specifically targeting these vulnerabilities has been reported to CISA at this time.
CISA recommends users take the following measures to protect themselves from social engineering attacks:
Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
Credit: Tomer Goldschmidt (Claroty Research - Team82)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-49398 | CWE-434 Unrestricted Upload of File with Dangerous Type | 9.1 Critical |
The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code. Mitigation: Elvaco believes that the remaining identified vulnerabilities require authentication to the device in order to be exploited posing less immediate risk. They are actively working to address these and will release an additional update shortly to mitigate any re… Vendor fix: Users of affected versions of M-Bus Metering Gateway CMe3100 are invited to contact Elvaco customer support for additional information. ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-49397 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 8.1 High |
The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin accounts. Vendor fix: Elvaco made security enhancements to software version 1.13.3 which is now available for download at CMe3100 Firmware Download. This release addresses and mitigates the risk of an attacker bypassing authentication to gain access to a device not hidden on priva… ↗ Mitigation: Elvaco believes that the remaining identified vulnerabilities require authentication to the device in order to be exploited posing less immediate risk. They are actively working to address these and will release an additional update shortly to mitigate any re… Vendor fix: Users of affected versions of M-Bus Metering Gateway CMe3100 are invited to contact Elvaco customer support for additional information. ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-49396 | CWE-522 Insufficiently Protected Credentials | 7.5 High |
The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information. Mitigation: Elvaco believes that the remaining identified vulnerabilities require authentication to the device in order to be exploited posing less immediate risk. They are actively working to address these and will release an additional update shortly to mitigate any re… Vendor fix: Users of affected versions of M-Bus Metering Gateway CMe3100 are invited to contact Elvaco customer support for additional information. ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-49399 | CWE-306 Missing Authentication for Critical Function | 7.5 High |
The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak information. Vendor fix: Elvaco made security enhancements to software version 1.13.3 which is now available for download at CMe3100 Firmware Download. This release addresses and mitigates the risk of an attacker bypassing authentication to gain access to a device not hidden on priva… ↗ Mitigation: Elvaco believes that the remaining identified vulnerabilities require authentication to the device in order to be exploited posing less immediate risk. They are actively working to address these and will release an additional update shortly to mitigate any re… Vendor fix: Users of affected versions of M-Bus Metering Gateway CMe3100 are invited to contact Elvaco customer support for additional information. ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-49397 | 9.2 Critical | Elvaco M-Bus Metering Gateway CMe3100 The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin accounts. |
| CVE-2024-49398 | 8.8 High | Elvaco M-Bus Metering Gateway CMe3100 The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code. |
| CVE-2024-49396 | 8.7 High | Elvaco M-Bus Metering Gateway CMe3100 The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false info… |
| CVE-2024-49399 | 8.7 High | Elvaco M-Bus Metering Gateway CMe3100 The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak informa… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.