CVE-2024-12399

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-17 · updated 2026-06-17
Weakness: CWE-924

Description

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication.

Affected products

Schneider Electric Pro-face GP-Pro EX: from all version before v5.00.100 — fixed in v5.00.100
Schneider Electric Pro-face Remote HMI: before v1.70.000 — fixed in v1.70.000

How to fix

Upgrade to a fixed version: Schneider Electric Pro-face GP-Pro EX v5.00.100; Schneider Electric Pro-face Remote HMI v1.70.000. Check the vendor advisory for mitigations.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-02.pdf

Get alerted when CVE-2024-12399 or the next vulnerability affects your stack