Vulnerability · Published Jan 17, 2025 · Assigned by schneider
CVE-2024-12476
High 7.8
In plain English
A high-severity XML external entity in Web Designer for BMENOC0311(C) from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 79.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstation integrity and potential remote code execution on the compromised computer, when specific crafted XML file is imported in the Web Designer configuration tool.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | Web Designer for BMXNOR0200H | All versions |
| Schneider Electric | Web Designer for BMXNOE0110(H) | All versions |
| Schneider Electric | Web Designer for BMENOC0311(C) | All Versions |
| Schneider Electric | Web Designer for BMENOC0321(C) | All Versions |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H