PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-6352 Schneider Electric CVE debrief

CVE-2024-6352 is a Schneider Electric Zigbee product issue that can let a malicious device joining the network trigger a buffer overflow and cause denial of service. The advisory was published on 2026-01-13 and later republished on 2026-01-27, with CISA’s CSAF notice linking the issue to multiple Schneider Electric Zigbee products, including Wiser iTRV2. The reported CVSS v3.1 score is 4.3 (Medium), reflecting adjacent-network exposure and low availability impact.

Vendor
Schneider Electric
Product
Wiser iTRV2
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-13
Original CVE updated
2026-01-27
Advisory published
2026-01-13
Advisory updated
2026-01-27

Who should care

Organizations using Schneider Electric Zigbee products, especially Wiser iTRV2 deployments and any environment that allows device pairing or network onboarding, should review this advisory. OT/IoT administrators responsible for Zigbee hubs, commissioning workflows, and device enrollment controls should prioritize it.

Technical summary

The source describes a CWE-120 buffer overflow that can be triggered when a malicious device joins the network. The supplied CVSS vector is AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, which indicates an adjacent-network attack surface, no privileges or user interaction required, and availability-only impact. The advisory’s mitigation guidance focuses on tightening Zigbee pairing and key-management practices rather than providing a reboot-based workaround.

Defensive priority

Medium priority: act promptly if Zigbee onboarding is exposed, but this is not a KEV-listed issue in the supplied corpus.

Recommended defensive actions

  • Do not allow unknown devices to join the Zigbee network.
  • Review how the Zigbee hub manages device pairing and commissioning.
  • Only open the network when adding new devices, and close it immediately afterward.
  • Use install codes where possible and replace default or well-known keys with unique secure keys.
  • Follow the product-specific guidance in Schneider Electric SEVD-2026-013-03 and CISA ICSA-26-027-03.

Evidence notes

All claims are based on the supplied CISA CSAF source item and its listed official references. The advisory text explicitly states a CWE-120 buffer overflow leading to denial of service when a malicious device joins the network. The CVSS vector and score are provided in the source metadata. No KEV entry or ransomware association is present in the supplied corpus. Timing references use the advisory publication and modification dates provided with the CVE record, not the CVE identifier year.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-6352 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-6352

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-6352 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-6352

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-027-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.se.com/ww/en/download/document/7EN52-0390/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-027-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.