Improper XML External Entity Handling in Schneider Electric's Web Designer Tool
CVE-2024-12476

8.4HIGH

Key Information:

Vendor
Schneider Electric
Status
Web Designer For Bmxnor0200h
Web Designer For Bmxnoe0110(h)
Web Designer For Bmenoc0311(c)
Web Designer For Bmenoc0321(c)
Vendor
CVE Published:
17 January 2025

Summary

A vulnerability related to improper handling of XML external entities exists within Schneider Electric's Web Designer configuration tool. This issue arises when a specially crafted XML file is imported, potentially leading to information disclosure. The flaw could compromise workstation integrity and may allow an attacker to execute remote code on affected systems, highlighting the significance of secure XML parsing practices.

Affected Version(s)

Web Designer for BMENOC0311(C) All Versions

Web Designer for BMENOC0321(C) All Versions

Web Designer for BMXNOE0110(H) All versions

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.