CVE-2024-6407 Schneider Electric CVE debrief

Who should care

OT and facilities teams using Schneider Electric Wiser Home Controller WHC-5918A, especially administrators responsible for network exposure, device lifecycle management, and credential protection.

Technical summary

The advisory describes a CWE-200 information exposure condition in Schneider Electric Wiser Home Controller WHC-5918A. A specially crafted message sent to the device may expose credentials. The supplied CISA CSAF record marks all versions as affected and associates the vulnerability with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exposure with no privileges or user interaction required. The remediation guidance also states the product is discontinued and out of support.

Defensive priority

Urgent. The issue is rated critical, appears network-reachable, and affects an out-of-support product with credential exposure risk.

Recommended defensive actions

• Identify any deployed Schneider Electric Wiser Home Controller WHC-5918A instances and confirm whether they are reachable from untrusted networks.
• Reduce exposure by isolating the device and limiting network access to only essential management sources.
• Plan migration to Schneider Electric’s recommended replacement product or remove the Wiser Home Controller WHC-5918A from service.
• Review dependent credentials and access paths associated with the device and rotate or replace credentials if there is any indication they may have been exposed.
• Follow Schneider Electric and CISA advisory guidance for any additional product-specific mitigation or lifecycle steps.

Evidence notes

All claims above are taken from the supplied CISA CSAF record and Schneider Electric notice references. The product is identified as Schneider Electric Wiser Home Controller WHC-5918A, all versions are listed as affected, and the remediation notes explicitly state the product is discontinued and out of support. Timing context: the CVE was published on 2024-07-09, and the CISA record was republished on 2026-01-30 based on Schneider Electric CPCERT SEVD-2024-191-01 advisory updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.