{"id":"CVE-2024-12476","state":"PUBLISHED","title":"CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could","description":"CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could\ncause information disclosure, impacts workstation integrity and potential remote code execution on the\ncompromised computer, when specific crafted XML file is imported in the Web Designer configuration tool.","publishedAt":"2025-01-17T09:42:47.616Z","updatedAt":"2025-02-12T17:13:56.687Z","severity":{"score":8.4,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"schneider"},"assigner":"schneider","products":["Schneider Electric Web Designer for BMXNOR0200H","Schneider Electric Web Designer for BMXNOE0110(H)","Schneider Electric Web Designer for BMENOC0311(C)","Schneider Electric Web Designer for BMENOC0321(C)"],"affected":[{"vendor":"Schneider Electric","product":"Web Designer for BMXNOR0200H","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]},{"vendor":"Schneider Electric","product":"Web Designer for BMXNOE0110(H)","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]},{"vendor":"Schneider Electric","product":"Web Designer for BMENOC0311(C)","defaultStatus":"unaffected","versions":[{"version":"All Versions","status":"affected"}]},{"vendor":"Schneider Electric","product":"Web Designer for BMENOC0321(C)","defaultStatus":"unaffected","versions":[{"version":"All Versions","status":"affected"}]}],"references":["https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-04.pdf"],"weaknesses":["CWE-611"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/12xxx/CVE-2024-12476.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-12476","state":"PUBLISHED","datePublished":"2025-01-17T09:42:47.616Z","dateUpdated":"2025-02-12T17:13:56.687Z","assignerShortName":"schneider","assignerOrgId":"076d1eb6-cfab-4401-b34d-6dfc2a413bdb","dateReserved":"2024-12-11T11:01:03.428Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could\ncause information disclosure, impacts workstation integrity and potential remote code execution on the\ncompromised computer, when specific crafted XML file is imported in the Web Designer configuration tool."}],"affected":[{"vendor":"Schneider Electric","product":"Web Designer for BMXNOR0200H","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]},{"vendor":"Schneider Electric","product":"Web Designer for BMXNOE0110(H)","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]},{"vendor":"Schneider Electric","product":"Web Designer for BMENOC0311(C)","defaultStatus":"unaffected","versions":[{"version":"All Versions","status":"affected"}]},{"vendor":"Schneider Electric","product":"Web Designer for BMENOC0321(C)","defaultStatus":"unaffected","versions":[{"version":"All Versions","status":"affected"}]}],"references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-04.pdf"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.4,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-611","description":"CWE-611 Improper Restriction of XML External Entity Reference","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"schneider","orgId":"076d1eb6-cfab-4401-b34d-6dfc2a413bdb","dateUpdated":"2025-01-17T09:42:47.616Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-17T13:18:38.223850Z","id":"CVE-2024-12476","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-12T17:13:56.687Z"}}]}}}