Cyber Resilience

CVE-2024-6758

Medium

Published: 12 August 2024

Published
12 August 2024
Modified
22 August 2025
KEV Added
Patch
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0021 43.9th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-6758 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Sprecher-Automation Sprecon-E Cp-2500 Firmware. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 43.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Improper Privilege Management in Sprecher Automation SPRECON-E below version 8.71j allows a remote attacker with low privileges to save unauthorized protection assignments.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

sprecher-automation
sprecon-e cp-2500 firmware
≤ 8.71j
sprecher-automation
sprecon-e-p dd6-2 firmware
≤ 8.71j
sprecher-automation
sprecon-e-c firmware
≤ 8.71j
sprecher-automation
sprecon-e ap-2200 firmware
≤ 8.71j
sprecher-automation
sprecon-e cp-2131 firmware
≤ 8.71j
sprecher-automation
sprecon-e cp-2330 firmware
≤ 8.71j
sprecher-automation
sprecon-e-p dq6-1 firmware
≤ 8.71j
sprecher-automation
sprecon-e-p dl6-1 firmware
≤ 8.71j
sprecher-automation
sprecon-e-p ds6-0 firmware
≤ 8.71j
sprecher-automation
sprecon-edir firmware
≤ 8.71j
+2 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-266

Designation of a manager and policy dissemination ensures privileges are assigned according to defined roles.

addresses: CWE-266

Regular reviews catch incorrect privilege assignments to users, roles, or processes.

addresses: CWE-266

Explicitly specifying privileges and group/role memberships for accounts reduces the risk of incorrect privilege assignments.

addresses: CWE-266

The control requires explicit definition of separated access authorizations, making incorrect privilege assignments that bundle conflicting duties harder to implement.

addresses: CWE-266

Ensures privileges are assigned only as necessary rather than incorrectly over-granted.

References