CVE-2024-11999

CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs malicious code into HMI product.

Score

CVSS 3.1 8.8 High

Status

Deferred - cybersecurity@se.com

Published

2024-12-17

Last modified

2024-12-17

Weaknesses

CWE-1104

Affected products

• Harmony Formerly Magelis Hmist6 (Schneider Electric)
• Hmig3u (Schneider Electric)
• Hmig3x (Schneider Electric)
• Hmistm6 (Schneider Electric)
• Hmisto7 Series With Ecostruxure Operator Terminal Expert Runtime (Schneider Electric)
• Pfxgp4100 Series With Pro-face Blue Runtime (Schneider Electric)
• Pfxsp5000 (Schneider Electric)
• Pfxst6000 (Schneider Electric)
• Pfxstm6000 (Schneider Electric)

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-02&p_enDocType=Security+and+Safety+Notice&p_File_…