// Description
# Schneider Electric Security Notification
09-Jul-24 Document Reference Number – SEVD-2024-191-01 Page 1 of 3
## Wiser Home Controller WHC-5918A
9 July 2024
## Overview
Schneider Electric is aware of a vulnerability in its Wiser Home Controller WHC-5918A product. The Wiser Home Controller WHC-5918A, a C-Bus based home automation controller, was discontinued on December 31, 2015. Failure to apply the mitigations provided below may risk credentials being stolen, which could result in the Wiser Home Controller WHC-5918A being compromised.
## Affected Products and Versions
Product Version Wiser Home Controller WHC-5918A All Versions of Wiser Home Controller WHC-5918A
## Vulnerability Details
CVE ID: CVE-2024-6407
CVSS v3.1 Base Score 9.8 | Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to the device.
Note regarding vulnerability details: The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment.
Affected Product Mitigations
Wiser Home Controller WHC-5918A
The Wiser Home Controller WHC-5918A product has been discontinued and is out of support. Customers should consider upgrading to the latest product offering, C-Bus, Home Controller, SpaceLogic IP, Free Standing, 24V DC, 5200WHC2, or removing the Wiser Home Controller WHC-5918A from service. Schneider Electric Security Notification
09-Jul-24 Document Reference Number – SEVD-2024-191-01 Page 2 of 3