CVE-2024-11999

HIGH
STIX 2.1 vulnerability

Record summary

CVE-2024-11999 has a selected CVSS score of 8.7 (high).

Description

CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs malicious code into HMI product.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 17, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Harmony (Formerly Magelis) HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series with EcoStruxure Operator Terminal Expert runtime

Browse Schneider Electric / Harmony (Formerly Magelis) HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series with EcoStruxure Operator Terminal Expert runtime

Default status: unaffected

CVE ListAll versionsaffected

PFXST6000, PFXSTM6000, PFXSP5000, PFXGP4100 series with Pro-face BLUE runtime

Browse Schneider Electric / PFXST6000, PFXSTM6000, PFXSP5000, PFXGP4100 series with Pro-face BLUE runtime

Default status: unaffected

CVE ListAll versionsaffected

References

2