CVE-2024-12703

highpriority · track · 0EPSS 0.003 · 23 %ileEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.31% (23rd) EPSS
CVSS 7.8 · high
Is it mine?
8 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-28

CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when a non-admin authenticated user opens a malicious project file.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedRemoteConnect and SCADAPack™ x70 Utilities - RemoteConnectcisa_csaf_ot

    Version R3.4.2 RemoteConnect configuration software includes a fix for this vulnerability and is available for download here:https://www.se.com/ww/en/download/document/RemoteConnect/

    https://www.se.com/ww/en/download/document/RemoteConnect/
  • MitigationRemoteConnect and SCADAPack™ x70 Utilities - RemoteConnectcisa_csaf_ot

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Schneider Electric is establishing a remediation plan for all future versions of Security Administrator configuration software that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit:• Only open project files received from a trusted source. • Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage.• Encrypt project file when stored and restrict the access to only trusted users. • When exchanging files over the network, use secure communication protocols. • Follow the SCADAPack™ Security Guidelines

    https://www.se.com/ww/en/download/document/SCADAPack_Cybersecurity_Guide/
  • MitigationRemoteConnect and SCADAPack™ x70 Utilities - Security Administratorcisa_csaf_ot

    Schneider Electric is establishing a remediation plan for all future versions of Security Administrator configuration software that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit:• Only open project files received from a trusted source. • Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage.• Encrypt project file when stored and restrict the access to only trusted users. • When exchanging files over the network, use secure communication protocols. • Follow the SCADAPack™ Security Guidelines

    https://www.se.com/ww/en/download/document/SCADAPack_Cybersecurity_Guide/
02

cvss

Technical severity, 0–10. One row per scoring source.

8.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–8.5

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.17.8highAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · cybersecurity@se.comexploitability 1.8 · impact 5.9
v4.08.5highCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.08.5highCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cybersecurity@se.com
v4.05.9mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USCWE-502USCWE-502US
05

affected products (8)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-25-028-06Schneider Electric RemoteConnect and SCADAPack x70 Utilities (Update A)2025-01-14icsa · cisa_csaf_otUS

    Schneider Electric is aware of a vulnerability in its RemoteConnect and SCADAPack™ x70 Utilities software product. The RemoteConnect and SCADAPack™ x70 Utilities https://www.se.com/ww/en/product-category/6000-telemetry-and-remote-scada-systems/ product is a configuration software providing a user interface that allows users to configure and manage communications and operations for SCADAPack™ x70 devices. Failure to apply the Mitigations provided below may risk deserialization of untrusted data, which could result in loss of confidentiality, integrity and potential remote code execution on the compromised workstation.

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otNVDCVE.orgMITRE
published 2025-01-17modified 2026-06-17
09

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan