Summary
Schneider Electric is aware of a vulnerability in its Harmony HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7
products used with EcoStruxure™ Operator Terminal Expert Software and PFXST6000, PFXSTM6000,
PFXSP5000, PFXGP4100 products used with Pro-face BLUE Software.
Harmony HMI Panels and Pro-face HMI Panels are the main visible automation component that manage all
vital machine features, including visualization, control, supervision, diagnostics, monitoring, and data logging.
Failure to apply the mitigations provided below may risk various attack scenarios due to Third-Party
Component obsolescence, which could result in complete loss of control, Integrity and Confidentiality of the
device and operational failure.
Vulnerabilities 1
-
High 8.8
CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the devi…
Revision history
-
#1.0.0
Original Release
References
-
Harmony HMI and Pro-face HMI products - SEVD-2024-345-02 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2024-345-02.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-25-010-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-010-02
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B