CVE-2024-12399 Other in Pro-face GP-Pro EX
Man-in-the-middle attacks can compromise confidentiality, integrity, and availability of Schneider Electric HMI communications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-12399?
CVE-2024-12399 is a medium-severity vulnerability in Schneider Electric Pro-face GP-Pro EX, published on 17 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication.
Weakness: CWE-924
Which versions are affected by CVE-2024-12399?
How do I fix CVE-2024-12399?
No fix has been published for CVE-2024-12399 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-12399 being exploited?
There is no known exploitation of CVE-2024-12399 in the wild and no public exploit code.
Sources
Also known as GHSA-5q3j-g5r8-6rfg.