Summary
Schneider Electric is aware of a vulnerability in its Wiser Home Controller WHC-5918A product.
The Wiser Home Controller WHC-5918A, a C-Bus based home automation controller, was
discontinued on December 31, 2015.
Failure to apply the mitigations provided below may risk credentials being stolen, which could
result in the Wiser Home Controller WHC-5918A being compromised.
Vulnerabilities 1
-
Critical 9.8
CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted …
Revision history
-
#3
CISA Republication update based on Schneider Electric CPCERT SEVD-2024-191-01 advisory
-
#2
Revision - Fixing typos
-
#1
Original Release
References
-
Wiser Home Controller WHC-5918A - SEVD-2024-191-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-25-112-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-03
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b