ifm electronic AC4xxS PLC CVE-2024-8419 Unauthenticated RCE via Missing Auth

Critical Vulnerability Information Vulnerability ID VDE-2024-061 Release Date 2025-06-30 12:00 (CEST) Last Updated 2025-06-27 09:51 (CEST) Vendor ifm electronic GmbH Affected Products and Versions Smart PLC AC4xxS Firmware: V4.04 < V4.3.17 Smart PLC AC4xxS Firmware: V6.1.8 Vulnerability Overview A vulnerability exists in the ifm AC4xxS PLC, allowing attackers to trigger a safety state via a specially crafted HTML request, resulting in loss of availability. CVE ID CVE-2024-8419 Last Update Time June 27, 2025, 09:50 AM Severity 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Weakness Missing authentication for critical functions (306) Vulnerability Details An endpoint hosts a script that, due to lack of authentication, allows unauthorized remote attackers to place the system into a fail-safe state over the network. Impact Unauthorized attackers can exploit this vulnerability to send malicious commands to the PLC, potentially disrupting or damaging production lines. Solutions and Mitigations When using automated components, ensure no unauthorized access occurs. Implement measures to prevent direct access to internet resources and avoid access from insecure networks. Use available security measures such as authentication and authorization groups. The HTTP interface of PLCs running firmware V6.1.8 can be disabled. Reporter CERT@VDE in coordination with ifm electronic GmbH Reported by Dmytro Kryhin from Igor Sikorsky Kyiv Polytechnic Institute, National Technical University of Ukraine

Goal Reached Thanks to every supporter — we hit 100%!

ifm electronic AC4xxS PLC CVE-2024-8419 Unauthenticated RCE via Missing Auth