Improper Message Integrity Enforcement in Schneider Electric's HMI Products
CVE-2024-12399

6.1MEDIUM

Key Information:

Vendor

Schneider Electric
Status
Pro-face Gp-pro Ex
Pro-face Remote Hmi
Vendor
CVE Published:
17 January 2025

What is CVE-2024-12399?

A vulnerability in Schneider Electric's HMI products could allow an attacker to execute a man-in-the-middle attack. This occurs due to improper enforcement of message integrity during transmission, which may result in partial loss of confidentiality, integrity, and availability of the HMI systems. Attackers could intercept communications, potentially leading to unauthorized access and manipulation of critical data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Pro-face GP-Pro EX all version

Pro-face Remote HMI all versions

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.