CVE-2024-12399 Schneider Electric CVE debrief

Who should care

Organizations using Schneider Electric Pro-face GP-Pro EX versions prior to 5.00.100 or Pro-face Remote HMI versions prior to 1.70.000 should review this immediately, especially OT/ICS teams responsible for HMI engineering workstations, remote access, and plant-floor networks. Security teams that allow remote HMI connections over untrusted or shared networks should prioritize it.

Technical summary

The affected products are Schneider Electric Pro-face GP-Pro EX versions prior to 5.00.100 and Pro-face Remote HMI versions prior to 1.70.000. The vulnerability is described as improper enforcement of message integrity during transmission in a communication channel (CWE-924). In the advisory, Schneider Electric states that an attacker performing a man-in-the-middle attack by intercepting communication could affect the HMI's confidentiality, integrity, and availability. The CVSS vector provided is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H, which indicates network exposure, no privileges required, and user interaction required.

Defensive priority

High. The issue affects HMI-related software used in industrial environments and is reachable over communications that can be intercepted if not protected. The vendor has already provided fixed versions, and the mitigations specifically call for encrypted remote access or disabling the feature when unused.

Recommended defensive actions

• Upgrade GP-Pro EX to version 5.00.100 or later using the vendor-provided fix.
• Upgrade Pro-face Remote HMI to version 1.70.000 or later from the Apple App Store or Google Play Store.
• If remote HMI is required, use Pro-face Connect or another VPN solution to encrypt communications between Pro-face Remote HMI and GP-Pro EX.
• Limit use to trusted networks and follow the Pro-face Cybersecurity Guidelines.
• Set a connection password as described in the GP-Pro EX reference manual.
• If Pro-face Remote HMI is not needed, disable the feature because it is deactivated by default.
• Verify affected assets against the advisory and prioritize remediation on exposed engineering and remote-access systems.

Evidence notes

All claims above are taken from the supplied CISA CSAF advisory data and Schneider Electric remediation notes. The source record identifies the affected vendor as Schneider Electric, product family Pro-face, affected versions prior to GP-Pro EX 5.00.100 and Remote HMI 1.70.000, and remediation availability added in the 2025-09-09 revision. The CVSS vector and the CWE-924 description come from the supplied source corpus.

Official resources