CVE-2024-12703: Deserialization RCE Vulnerability

CVE-2024-12703 Overview

CVE-2024-12703 is a deserialization of untrusted data vulnerability [CWE-502] affecting a Schneider Electric engineering product. The flaw allows an authenticated non-administrative user to trigger remote code execution by opening a malicious project file on a workstation. Successful exploitation leads to loss of confidentiality, integrity, and availability on the target host. The issue was published to the National Vulnerability Database on January 17, 2025 and carries a CVSS v4.0 base score of 8.5.

Critical Impact
Opening a crafted project file allows an attacker to execute arbitrary code in the context of the authenticated user, compromising the workstation used for engineering or configuration tasks.

Affected Products

Schneider Electric engineering software (see vendor advisory SEVD-2025-014-06 for exact product and version list)
Workstations used to open Schneider Electric project files
Non-administrator user sessions running the affected software

Discovery Timeline

2025-01-17 - CVE-2024-12703 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12703

Vulnerability Analysis

The vulnerability stems from unsafe deserialization of project file content. The affected Schneider Electric software reconstructs objects from a project file without validating type information or enforcing an allowlist of safe classes. An attacker crafts a project file that embeds serialized objects. When the workstation user opens the file, the deserializer instantiates attacker-controlled types and invokes methods during object reconstruction. This leads to arbitrary code execution in the security context of the local user.

The attack vector is local, and exploitation requires user interaction. No prior privileges are needed beyond the ability to authenticate to the workstation as a standard user. The impact on confidentiality, integrity, and availability is rated high because the executed code inherits the user's access to project data, credentials cached by the engineering tool, and any connected industrial systems.

Root Cause

The root cause is the acceptance of serialized object graphs from untrusted files without gadget-chain mitigation. Deserialization routines do not restrict permitted types, do not validate signatures on project files, and do not sandbox object reconstruction.

Attack Vector

An attacker delivers a weaponized project file through email, shared network storage, USB media, or a supply-chain compromise of an integrator. The victim, an engineer or operator with standard user rights, opens the file in the affected application. Deserialization triggers execution of embedded gadgets, giving the attacker code execution on an operational technology (OT) engineering workstation. Refer to the Schneider Electric Security Notice SEVD-2025-014-06 for product-specific technical details.

Detection Methods for CVE-2024-12703

Indicators of Compromise

Unexpected child processes spawned by the Schneider Electric engineering application, such as cmd.exe, powershell.exe, or rundll32.exe.
Project files (.project, .apx, .stu, or vendor-specific extensions) sourced from untrusted email attachments, external drives, or unfamiliar network shares.
New scheduled tasks, services, or autorun entries created shortly after a project file is opened.
Outbound network connections from the engineering workstation to unfamiliar hosts following project file activity.

Detection Strategies

Alert on the Schneider Electric engineering process creating interactive shells, scripting hosts, or writing executables to disk.
Hunt for file writes to %APPDATA%, %TEMP%, or %PUBLIC% originating from the engineering application immediately after a project file open event.
Correlate project file arrival events (email, file share writes) with subsequent process execution on the workstation.
Track loading of .NET serialization gadgets or unusual assemblies within the engineering software process space.

Monitoring Recommendations

Collect endpoint process, file, and network telemetry from all engineering workstations and forward to a centralized SIEM.
Baseline normal project file activity, then alert on deviations such as opens from non-standard directories.
Monitor egress traffic from OT engineering subnets, where interactive command-and-control patterns should be rare.
Audit user accounts on engineering workstations to ensure non-admin users cannot install persistence.

How to Mitigate CVE-2024-12703

Immediate Actions Required

Apply the fixed version listed in Schneider Electric advisory SEVD-2025-014-06 as soon as it is available for your deployment.
Restrict engineering workstations to project files originating from trusted, authenticated sources only.
Enforce application allowlisting on engineering workstations to block scripting hosts and unexpected child processes.
Segment engineering workstations from general-purpose corporate networks and email systems.

Patch Information

Refer to the Schneider Electric Security Notice SEVD-2025-014-06 for the authoritative list of fixed versions, remediation steps, and product coverage.

Workarounds

Only open project files received through verified channels and validated against known-good hashes.
Store project files on access-controlled repositories with integrity monitoring and reject files from external media.
Run the engineering application under a dedicated low-privilege user account with no administrative rights or credential caches.
Disable email clients and web browsers on engineering workstations to reduce the delivery surface for malicious project files.

bash

# Example: enforce blocking of scripting hosts spawned by an engineering app via WDAC/AppLocker policy (conceptual)
# Deny cmd.exe, powershell.exe, wscript.exe, cscript.exe when parent is the engineering executable
# Consult vendor documentation before deploying in production OT environments