CVE-2024-12399

CVE-2024-12399 is a CWE-924 vulnerability involving improper enforcement of message integrity during transmission in a communication channel. It affects the Human-Machine Interface (HMI), potentially leading to partial loss of confidentiality, loss of integrity, and availability when communications are intercepted. The vulnerability was published on 2025-01-17 with a CVSS v3.1 base score of 7.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H).

An attacker with network access can exploit this vulnerability by performing a man-in-the-middle attack to intercept HMI communications. Exploitation requires high attack complexity and user interaction, but no privileges. Successful attacks can achieve partial loss of confidentiality, high impact on integrity, and high impact on availability of the HMI.

Schneider Electric has published Security and Safety Notice SEVD-2025-014-02, available at https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-02.pdf, which provides details on mitigations for this vulnerability.