CVE-2024-12399

medium

Description

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication.

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-07

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-02.pdf

Details

Source: Mitre, NVD

Published: 2025-01-17

Updated: 2026-04-15

Risk Information

CVSS v2

Base Score: 7.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.1

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H

Severity: High

CVSS v4

Base Score: 6.1

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00023