Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Schneider Electric Pro-face GP-Pro EX

CVE-2024-12399
MEDIUM 6.1

At a glance

Source
NVD
EPSS
EPSS 0.17 % · percentile 6 ()
State
PUBLISHED
Published
Updated
Assigner
schneider
NVD status
Deferred

Search on…

Description

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication.

Weaknesses (CWE)

  • CWE-924 — Improper Enforcement of Message Integrity During Transmission in a Communication Channel

References

Scores

VersionScoreVectorScored by
CVSS 4.0MEDIUM 6.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:Nschneider
CVSS 3.1HIGH 7.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:Hschneider
CVSS 4.0MEDIUM 6.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · cybersecurity@se.com (Secondary)
CVSS 3.1HIGH 7.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:HNVD · cybersecurity@se.com (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
Schneider Electric · Pro-face GP-Pro EXaffected all version < v5.00.100
Schneider Electric · Pro-face Remote HMIaffected all versions < v1.70.000

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD