Cyber Resilience

CVE-2024-12399

Medium

Published: 17 January 2025

Published
17 January 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v4 6.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0027 50.4th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-12399 is a medium-severity Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CWE-924) vulnerability in Schneider Electric (inferred from references). Its CVSS base score is 6.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked in the top 49.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SC-23 (Session Authenticity).

Deeper analysis

CVE-2024-12399 is a CWE-924 vulnerability involving improper enforcement of message integrity during transmission in a communication channel. It affects the Human-Machine Interface (HMI), potentially leading to partial loss of confidentiality, loss of integrity, and availability when communications are intercepted. The vulnerability was published on 2025-01-17 with a CVSS v3.1 base score of 7.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H).

An attacker with network access can exploit this vulnerability by performing a man-in-the-middle attack to intercept HMI communications. Exploitation requires high attack complexity and user interaction, but no privileges. Successful attacks can achieve partial loss of confidentiality, high impact on integrity, and high impact on availability of the HMI.

Schneider Electric has published Security and Safety Notice SEVD-2025-014-02, available at https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-02.pdf, which provides details on mitigations for this vulnerability.

EU & UK References

Vulnerability details

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the…

more

communication.

CWE(s)
CWE-924

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Why these techniques?

Lack of message integrity enforcement directly enables MITM interception of HMI network communications.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2019-25719Shared CWE-924
CVE-2025-0592Shared CWE-924

Affected Assets

Schneider Electric
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-8 Transmission Confidentiality and Integrity good match
prevent

Directly mandates protection of transmission integrity and confidentiality, preventing man-in-the-middle interception and alteration of HMI communications.

SC-23 Session Authenticity good match
prevent

Establishes and maintains session authenticity to specifically counter man-in-the-middle attacks exploiting improper message integrity enforcement.

SC-13 Cryptographic Protection good match
prevent

Implements cryptographic protections that enforce message integrity during transmission in communication channels vulnerable to MitM attacks.

References