CVE-2024-8884 Schneider Electric CVE debrief

Who should care

Organizations operating Schneider Electric Harmony Industrial PC or Pro-face PS5000 legacy Industrial PC deployments that use the System Monitor application should treat this as urgent, especially where the application is reachable on networked HTTP/HTTPS ports.

Technical summary

The source advisory maps this issue to CWE-200 (Information Exposure) and lists a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). The affected products are Schneider Electric System Monitor application in Harmony Industrial PC and in Pro-face Industrial PC, both listed as all versions in the CSAF record. The source states that credentials may be exposed when an attacker has access to the application over HTTP. Schneider Electric’s remediation is uninstalling the System Monitor application via the vendor-provided uninstallers; interim mitigations include stopping the system monitor service if not needed and blocking unauthorized access to configured HTTP/HTTPS ports.

Defensive priority

Immediate. This is a network-reachable, no-authentication issue with high confidentiality, integrity, and availability impact in the advisory’s scoring, so remediation and exposure reduction should be prioritized.

Recommended defensive actions

• Remove the System Monitor application using the vendor-provided uninstaller for the affected Harmony Industrial PC or Pro-face PS5000 environment.
• If you cannot uninstall immediately, stop the system monitor service if it is not required, following the relevant user guide.
• Restrict network exposure by segmenting the environment and blocking unauthorized access to configured HTTP/HTTPS ports with a firewall.
• Test the uninstall or mitigation in a development or offline environment first, and maintain backups before changing operational systems.
• Review whether the affected application is reachable from any broader enterprise or remote-access network and remove unnecessary access paths.

Evidence notes

Statements in this debrief are limited to the supplied CISA CSAF source record for CVE-2024-8884 and the referenced Schneider Electric/CISA advisory links. The source identifies the affected products, CWE-200 classification, HTTP-based exposure condition, CVSS vector and score, and vendor remediation/mitigation guidance. No KEV listing is present in the supplied corpus.

Official resources