MSGID: 2:263/1.0 5b6f45fb   
   TZUTC: 0100   
   CHRS: CP850 2   
   Schneider Electric Wiser Home Controller WHC-5918A   
      
   
View   
   CSAF
   
   
1. EXECUTIVE SUMMARY
   
   
   
   
CVSS v4 9.3
   
   
ATTENTION: Exploitable remotely/low attack complexity
   
   
Vendor: Schneider Electric
   
   
Equipment: Wiser Home Controller WHC-5918A
   
   
Vulnerability: Exposure of Sensitive Information to an   
   Unauthorized Actor
   
   
   
   
2. RISK EVALUATION
   
   
Successful exploitation of this vulnerability could allow an attacker to   
   disclose sensitive credentials.
   
   
3. TECHNICAL DETAILS
   
   
3.1 AFFECTED PRODUCTS
   
   
Schneider Electric reports the following products are affected:
   
   
   
   
Wiser Home Controller WHC-5918A: All versions
   
   
   
   
3.2 VULNERABILITY OVERVIEW
   
   
3.2.1 EXPOSURE OF SENSITIVE INFORMATION TO AN   
   UNAUTHORIZED ACTOR CWE-200
   
   
An information exposure vulnerability exists that could cause disclosure of   
   credentials when a specially crafted message is sent to the device.
   
   
CVE-2024-6407 has been assigned to this vulnerability. A   
   CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H   
   ).
   
   
A CVSS v4 score has also been calculated for CVE-2024-6407. A base score of 9.3 has been calculated;   
   the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N   
   ).
   
   
3.3 BACKGROUND
   
   
   
   
CRITICAL INFRASTRUCTURE SECTORS: Energy
   
   
COUNTRIES/AREAS DEPLOYED: Worldwide
   
   
COMPANY HEADQUARTERS LOCATION: France
   
   
   
   
3.4 RESEARCHER
   
   
Schneider Electric reported this vulnerability to CISA.
   
   
4. MITIGATIONS
   
   
Schneider Electric reports the Wiser Home Controller WHC-5918A product has   
   been discontinued and is out of support. Users should consider upgrading to   
   the latest product offering, C-Bus, Home Controller, SpaceLogic IP, Free   
   Standing, 24V DC, 5200WHC2, or removing the Wiser Home Controller WHC-5918A   
   from service.
   
   
CISA recommends users take defensive measures to minimize the risk of   
   exploitation of this vulnerability, such as:
   
   
   
   
Minimize network exposure for all control system devices and/or systems,   
   ensuring they are not accessible from the I   
   ternet.
   
   
Locate control system networks and remote devices behind firewalls and   
   isolating them from business networks.
   
   
When remote access is required, use more secure methods, such as Virtual   
   Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be   
   updated to the most recent version available, and are only as secure as the   
   connected devices.
   
   
   
   
CISA reminds organizations to perform proper impact analysis and risk   
   assessment prior to deploying defensive measures.
   
   
CISA also provides a section for control systems   
   security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense   
   best practices are available for reading and download, including Improving Industrial   
   Control Systems Cybersecurity with Defense-in-Depth Strategies.
   
   
CISA encourages organizations to implement recommended cybersecurity   
   strategies for proactive defense of ICS assets.
   
   
Additional mitigation guidance and recommended practices are publicly   
   available on the ICS webpage at cisa.gov in the technical information   
   paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and   
   Mitigation Strategies.
   
   
Organizations observing suspected malicious activity should follow   
   established internal procedures and report findings to CISA for tracking and   
   correlation against other incidents.
   
   
CISA also recommends users take the following measures to protect themselves   
   from social engineering attacks:
   
   
   
   
Do not click web links or open attachments in unsolicited email   
   messages.
   
   
Refer to Recognizing and Avoiding Email   
   Scams for more information on avoiding email scams.
   
   
Refer to Avoiding Social Engineering and Phishing Attacks for more   
   information on social engineering attacks.
   
   
   
   
No known public exploitation specifically targeting this vulnerability has   
   been reported to CISA at this time.
   
   
5. UPDATE HISTORY
   
   
   
   
April 22, 2025: Initial Republication of Schneider Electric Advisory   
   SEVD-2024-191-01
   
   
   
      
   https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-03   
      
   2025-04-22 12:00 UTC   
      
   --- BBBS/LiR v4.10 Toy-7   
    * Origin: MoscowTimes feed - READ ONLY (2:263/1)   
   SEEN-BY: 105/81 124/5016 128/187 135/115 153/757 154/30 110 203/0   
   SEEN-BY: 221/0 226/30 227/114 229/110 114 300 307 426 470 700 705   
   SEEN-BY: 240/1120 263/1 280/464 291/111 292/854 301/1 310/31 341/66   
   SEEN-BY: 460/58 467/888 633/280 902/26 5020/715   
   PATH: 263/1 280/464 292/854 229/426