PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-11999 Schneider Electric CVE debrief

A high-severity vulnerability (CVSS 8.8) in Schneider Electric Harmony and Pro-face HMI products, published December 10, 2024, allows authenticated attackers to achieve complete device control by installing malicious code. The root cause is CWE-1104: Use of Unmaintained Third-Party Components. The attack requires network access and low-privilege authentication, with no user interaction needed. Affected products include Harmony HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series with EcoStruxure Operator Terminal Expert runtime, and Pro-face PFXST6000, PFXSTM6000, PFXSP5000, PFXGP4100 series with Pro-face BLUE runtime—all versions. No patch is available; mitigation relies on network segmentation, access restrictions, and secure file handling practices.

Vendor
Schneider Electric
Product
Harmony with EcoStruxureTM Operator Terminal Expert runtime
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-12-10
Original CVE updated
2024-12-10
Advisory published
2024-12-10
Advisory updated
2024-12-10

Who should care

Industrial control system operators, OT security teams, manufacturing security engineers, critical infrastructure defenders, and organizations using Schneider Electric Harmony or Pro-face HMI products in production environments

Technical summary

The vulnerability stems from unmaintained third-party components in Schneider Electric's HMI runtime environments. An authenticated attacker with network access can install malicious code, resulting in complete confidentiality, integrity, and availability compromise of the device. The attack vector is network-based with low attack complexity, requiring low privileges but no user interaction. No patch exists; defense relies on architectural controls including network isolation, firewall rules, media restrictions, and code integrity verification.

Defensive priority

high

Recommended defensive actions

  • Isolate affected HMI systems from public internet and untrusted networks through network segmentation
  • Deploy firewalls to block unauthorized access to HMI devices
  • Restrict use of unverifiable portable media with affected systems
  • Limit application access to prevent unauthorized firmware transfers to HMI devices
  • Implement rootkit scanning and digital signature verification for all software/files before use on HMI systems
  • Enforce secure communication protocols for all network file exchanges
  • Review and apply Schneider Electric security notice SEVD-2024-345-02 guidance
  • Monitor CISA ICS advisories for future patch availability

Evidence notes

CISA ICS advisory ICSA-25-010-02 and Schneider Electric security notice SEVD-2024-345-02 confirm the vulnerability affects all versions of specified HMI product lines. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-exploitable, low-complexity attacks requiring authenticated access. No KEV listing or known ransomware campaign use is documented.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-11999 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-11999

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-11999 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-11999

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-010-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.se.com/us/en/download/document/7EN52-0390/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.