CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication…
Priority LOW 28CWE-924Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Fixed Pro-face GP-Pro EX (Schneider Electric): v5.00.100Pro-face Remote HMI (Schneider Electric): v1.70.000
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schneider Electric | Pro-face GP-Pro EX | all version to before v5.00.100 | v5.00.100 | Patch available | CNA |
| Schneider Electric | Pro-face Remote HMI | all versions to before v1.70.000 | v1.70.000 | Patch available | CNA |
- Pro-face GP-Pro EX VendorSchneider Electric Affected all version to before v5.00.100 Fixed in v5.00.100 Patch available CNA
- Pro-face Remote HMI VendorSchneider Electric Affected all versions to before v1.70.000 Fixed in v1.70.000 Patch available CNA
Remediation
- Fix · CNA Pro-face GP-Pro EX (Schneider Electric) Fixed in v5.00.100
- Fix · CNA Pro-face Remote HMI (Schneider Electric) Fixed in v1.70.000
Timeline
- 2026-10-02 Threatist record created from CVE-2024-12399
- 2026-10-03 Alias added: GHSA-5q3j-g5r8-6rfg
References
More Schneider Electric vulnerabilities
- TI-2018-05679 SQL injection in U.motion Builder software version 1.3.4 KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05589 Hard-coded credentials in EVlink City , EVlink Parking , and EVlink Smart Wallbox CVSS 3.1CRITICAL 9.8
- TI-2022-15561 OS command injection in Schneider Electric SpaceLogic C-Bus Home Controller CVSS 3.1HIGH 8.8
- TI-2023-04970 Path traversal in Schneider Electric C-Bus Toolkit CVSS 3.1CRITICAL 9.8
- TI-2019-04862 Improper handling of exceptional conditions in Schneider Electric Modicon M580 CVSS 3.1HIGH 7.5
- TI-2018-05690 Improper handling of exceptional conditions in Modicon M580 Modicon M340 Modicon Quantum… CVSS 3.1HIGH 7.5
Sources
- CVE-2024-12399 · CVE Program
- CVE-2024-12399 · NVD
- FIRST EPSS
- GHSA-5q3j-g5r8-6rfg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences