Schneider Electric Pro-face GP-Pro EX and Remote HMI

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 6.1
  • ATTENTION: Exploitable remotely
  • Vendor: Schneider Electric
  • Equipment: Pro-face GP-Pro EX and Remote HMI
  • Vulnerability: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow man-in-the-middle attacks, resulting in information disclosure, integrity issues, and operational failures.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of Pro-face GP-Pro EX and Remote HMI are affected:

  • Pro-face GP-Pro EX: All versions
  • Pro-face Remote HMI: All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER ENFORCEMENT OF MESSAGE INTEGRITY DURING TRANSMISSION IN A COMMUNICATION CHANNEL CWE-924

The affected products are vulnerable to an improper enforcement of message integrity during transmission in a communication channel vulnerability that could cause partial loss of confidentiality, loss of integrity, and availability of the HMI when attacker performs man-in-the-middle attack by intercepting the communication.

CVE-2024-12399 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-12399. A base score of 6.1 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.

This article has been indexed from All CISA Advisories

Read the original article: