CVE-2024-12703 Schneider Electric CVE debrief

Who should care

Organizations that use Schneider Electric RemoteConnect or SCADAPack™ x70 Utilities, especially engineering, operations, and support teams that open or exchange project files. Security teams responsible for workstation hardening, file integrity controls, and ICS software patch management should prioritize this advisory.

Technical summary

The vulnerability is a deserialization weakness in project file handling. The described attack path requires a non-admin authenticated user to open a malicious project file, at which point the flaw can affect confidentiality and integrity and may lead to remote code execution on the workstation. The advisory maps the issue to CWE-502 and lists CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 HIGH). A fixed RemoteConnect release is available in R3.4.2; Security Administrator remains pending remediation, with interim mitigations recommended by the vendor.

Defensive priority

High priority. Apply the RemoteConnect fix promptly if the product is in use, and for Security Administrator use the vendor mitigations until an updated release is available. Because the trigger involves opening a malicious project file, file provenance and integrity controls are immediately relevant.

Recommended defensive actions

• Upgrade RemoteConnect to version R3.4.2 or later using the vendor-provided fix.
• For Security Administrator, apply Schneider Electric's interim mitigations until a remediation is released.
• Only open project files from trusted sources.
• Compute and verify file hashes before opening project files.
• Encrypt stored project files and restrict access to trusted users only.
• Use secure communication protocols when exchanging files over the network.
• Follow Schneider Electric's SCADAPack™ Security Guidelines and CISA ICS recommended practices.

Evidence notes

All claims are drawn from the supplied CISA CSAF advisory metadata and the referenced Schneider Electric notice. The affected versions, remediation status, and mitigation language come from the advisory content; the CVSS vector and CWE mapping come from the provided source corpus. No exploit details beyond the advisory's user-opening scenario are included.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.