Description
CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete
control of the device when an authenticated user installs malicious code into HMI product.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Harmony (Formerly Magelis) HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series with EcoStruxure Operator Terminal Expert runtime | All versions | — |
| Schneider Electric | PFXST6000, PFXSTM6000, PFXSP5000, PFXGP4100 series with Pro-face BLUE runtime | All versions | — |
Advisories 2
- ICSA-25-010-02 Schneider Electric Harmony HMI and Pro-Face HMI Products CISA ICS & IT advisories · Dec 10, 2024
- SEVD-2024-345-02 Harmony HMI and Pro-face HMI products Schneider Electric CPCERT · Dec 10, 2024