CVE-2024-12703

Schneider Electric RemoteConnect and SCADAPack™ x70 Utilities - RemoteConnect — vulnerability CVE-2024-12703

CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when a non-admin authenticated user opens a malicious project file.

CVSS 7.8Patch available

This record: live connection— last retrieved: 7 November 2026 at 19:27.

Vendor

Schneider Electric

Products

RemoteConnect and SCADAPack™ x70 Utilities - RemoteConnect, RemoteConnect and SCADAPack™ x70 Utilities - Security Administrator, RemoteConnect configuration software, Security Administrator configuration software

up to version vers:generic/<R3.4.2

Published

17 January 2025

Last modified

17 June 2026

Original source information

Taken directly from NVD, CISA or the vendor — sometimes in English, unchanged from the source.

Technical description

CVSS 3.1 — vector details

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

LOCAL

Privileges required

NONE

User interaction

REQUIRED

Confidentiality

High

Integrity

High

Availability

High

EPSS — Exploit Prediction Scoring System

Probability of exploitation within 30 days

0.3%

Percentile

24e

Source: FIRST.org, updated on 7 November 2026.

Patch information

Version R3.4.2 RemoteConnect configuration software includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/RemoteConnect/

IACS Radar assessment

Our own interpretation and context for the source data above.

IACS Radar assessment

Our own interpretation and context for this vulnerability — not an official source.

IACS Radar priority score

47/ 100

Based on CVSS 7.8, EPSS 0.3%, industrial relevance 55/100.

Combines CVSS, EPSS, KEV status, industrial relevance and exposure relevance — a complement to, not a replacement for, the individual scores below and above.

Conditions for exploitation

•Local or adjacent access to the device is required.
•No valid credentials are needed.
•User interaction (for example opening a file) is required.

Operational impact & energy relevance

Possible loss of visibility of or control over the process upon successful exploitation.

Assessed as relevant to the energy sector based on: Vermeld in een officiële CISA ICS Advisory, wat directe relevantie voor industriële besturingssystemen bevestigt. Vendor "Schneider Electric" is a known supplier of equipment for the energy sector.

Recommended defensive measures

•Apply the latest firmware or software update and validate its integrity.
•Restrict network access to the affected device to a dedicated OT management segment.
•Implement network segmentation in line with zones and conduits (IEC 62443-3-2).
•Monitor for abnormal protocol traffic using an OT-aware detection system.

Industrial relevance score

55/ 100

• Mentioned in an official CISA ICS advisory, which confirms direct relevance to industrial control systems.
• Vendor "Schneider Electric" is a known supplier of equipment for the energy sector.

Classification is provisional; manual verification by an OT security analyst is recommended.

Classified by IACS Radar-analysepijplijn (geautomatiseerd) on 7 November 2026.

IEC 62443 mapping

IEC 62443-4-1FR3 · Systeemintegriteit

Automatic IACS Radar assessment based on the reported CWE weakness classification; not an official certification statement.

Loading vulnerabilities…