IM
IronMonkey Threat Research
‹ Back to ICS Advisories

Harmony HMI and Pro-face HMI products

HIGH
CVSS 8.8
Date 2026-10-16T20:32:54+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 10-Dec-24 Document Reference Number – SEVD-2024 -345-02 Page 1 of 4 ## Harmony HMI and Pro-face HMI products 10 December 2024 ## Overview Schneider Electric is aware of a vulnerability in its Harmony HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 products used with EcoStruxure™ Operator Terminal Expert Software and PFXST6000, PFXSTM6000, PFXSP5000, PFXGP4100 products used with Pro-face BLUE Software. Harmony HMI Panels and Pro-face HMI Panels are the main visible automation component that manage all vital machine features, including visualization, control, supervision, diagnostics, monitoring, and data logging. Failure to apply the mitigations provided below may risk various attack scenarios due to Third-Party Component obsolescence, which could result in complete loss of control, Integrity and Confidentiality of the device and operational failure. ## Affected Products and Versions Product Version Harmony (Formerly Magelis) HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series with EcoStruxure TM Operator Terminal Expert runtime All versions PFXST6000, PFXSTM6000, PFXSP5000, PFXGP4100 series with Pro-face BLUE runtime All versions ## Vulnerability Details CVE ID: CVE-2024-11999 CVSS v3.1 Base Score 8.8 | High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS v4.0 Base Score 8.7 | High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs malicious code into HMI product.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2024-11999 8.8 high
CVE-2024-11999. CWE-1104: Use of Unmaintained Third-Party Components exists that could cause complete control of the device when an authenticated user installs malicious code into HMI product.

// Affected Products (2)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Schneider Electric Pro-face HMI with Pro-face BLUE runtime hmi
L2
--
Schneider Electric Schneider Electric Harmony with EcoStruxureTM Operator Terminal Expert runtime engineering_workstation
L3
--

// Remediations (1)

Mitigation: Customers should immediately apply the following mitigations to reduce the risk of exploit: • Use
Customers should immediately apply the following mitigations to reduce the risk of exploit: • Use HMI only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. • Setup network segmentation and implement a firewall to block all unauthorized access. • Restrict usage of unverifiable portable media • Restricting the application access to limit the transfer of Firmware to HMIScanning of software/files for rootkits before usage and verifying the digital signature. • When exchanging files over the network, use secure communication protocols.

// References