{"id":"CVE-2024-5559","published":"2024-06-12T17:18:04Z","modified":"2024-08-01T21:18:06Z","title":"CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service…","vendor":"Schneider Electric","product":"PowerLogic P5","tier":"core","eol":null,"affectedVersions":[{"vendor":"Schneider Electric","product":"PowerLogic P5","versions":["v01.500.104 and prior"]}],"description":{"text":"CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could\ncause denial of service, device reboot, or an attacker gaining full control of the relay when a\nspecially crafted reset token is entered into the front panel of the device.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00181,"percentile":0.0767,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":3,"pulses":[{"name":"MuddyWater Exposed: Inside an Iranian APT operation","url":"https://otx.alienvault.com/pulse/69acdc94b7bc2b107f5b8c7a","created":"2026-03-08"},{"name":"avault clone \"MuddyWater Exposed: Inside an Iranian APT operation\"","url":"https://otx.alienvault.com/pulse/69aa31beeac4a66ce154d29a","created":"2026-03-06"},{"name":"MuddyWater Exposed: Inside an Iranian APT operation","url":"https://otx.alienvault.com/pulse/69a99ec6f661182b3a0c1aa5","created":"2026-03-05"}],"provenance":"machine"},"cwes":[{"id":"CWE-327","name":"Use of a Broken or Risky Cryptographic Algorithm"}],"references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-02.pdf","tags":[]}],"techniques":[],"reports":[{"id":"SRC-6456fe61781512dde412","title":"MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","publisher":"ctrlaltintel.com","url":"https://ctrlaltintel.com/research/MuddyWater/","date":"2026-03-04","mentions":[{"quote":"We observed the threat actor had modified the watchTowr CVE-2024-5559 POC that would allow for RCE.","start":6825,"end":6924}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-46758","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-46758","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-06-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-5559","provenance":"source"},{"date":"2026-03-04","kind":"report","label":"Named in ctrlaltintel.com: MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","url":"https://ctrlaltintel.com/research/MuddyWater/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":11.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":1.53,"detail":"percentile 0.0767"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":4.27,"detail":"base score 6.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}