Improper Message Integrity Enforcement in Schneider Electric's HMI Products
CVE-2024-12399
6.1MEDIUM
Key Information:
- Vendor
- Schneider Electric
- Vendor
- CVE Published:
- 17 January 2025
Summary
A vulnerability in Schneider Electric's HMI products could allow an attacker to execute a man-in-the-middle attack. This occurs due to improper enforcement of message integrity during transmission, which may result in partial loss of confidentiality, integrity, and availability of the HMI systems. Attackers could intercept communications, potentially leading to unauthorized access and manipulation of critical data.
Affected Version(s)
Pro-face GP-Pro EX All versions
Pro-face Remote HMI All versions
References
CVSS V4
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved