PatchSiren cyber security CVE debrief

CVE-2024-6407 Schneider Electric CVE debrief

CVE-2024-6407 is a critical information exposure issue affecting Schneider Electric Wiser Home Controller WHC-5918A devices. According to the advisory, a specially crafted message sent to the device could disclose credentials. CISA’s CSAF record lists all versions of the product as affected and rates the issue CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Schneider Electric’s remediation notes state the product has been discontinued and is out of support, so the preferred response is to upgrade to a current replacement or remove the device from service.

Vendor: Schneider Electric
Product: Wiser Home Controller WHC-5918A
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-07-09
Original CVE updated: 2026-01-30
Advisory published: 2024-07-09
Advisory updated: 2026-01-30

Who should care

OT and facilities teams using Schneider Electric Wiser Home Controller WHC-5918A, especially administrators responsible for network exposure, device lifecycle management, and credential protection.

Technical summary

The advisory describes a CWE-200 information exposure condition in Schneider Electric Wiser Home Controller WHC-5918A. A specially crafted message sent to the device may expose credentials. The supplied CISA CSAF record marks all versions as affected and associates the vulnerability with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exposure with no privileges or user interaction required. The remediation guidance also states the product is discontinued and out of support.

Defensive priority

Urgent. The issue is rated critical, appears network-reachable, and affects an out-of-support product with credential exposure risk.

Recommended defensive actions

Identify any deployed Schneider Electric Wiser Home Controller WHC-5918A instances and confirm whether they are reachable from untrusted networks.
Reduce exposure by isolating the device and limiting network access to only essential management sources.
Plan migration to Schneider Electric’s recommended replacement product or remove the Wiser Home Controller WHC-5918A from service.
Review dependent credentials and access paths associated with the device and rotate or replace credentials if there is any indication they may have been exposed.
Follow Schneider Electric and CISA advisory guidance for any additional product-specific mitigation or lifecycle steps.

Evidence notes

All claims above are taken from the supplied CISA CSAF record and Schneider Electric notice references. The product is identified as Schneider Electric Wiser Home Controller WHC-5918A, all versions are listed as affected, and the remediation notes explicitly state the product is discontinued and out of support. Timing context: the CVE was published on 2024-07-09, and the CISA record was republished on 2026-01-30 based on Schneider Electric CPCERT SEVD-2024-191-01 advisory updates.

Official resources

Initial CVE publication date: 2024-07-09. CISA republication update date: 2026-01-30, based on Schneider Electric CPCERT SEVD-2024-191-01 advisory.