Filtered by vendor Schneider-electric Subscriptions
Filtered by product Ecostruxure Operator Terminal Expert Subscriptions
Total 12 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-1049 1 Schneider-electric 2 Ecostruxure Operator Terminal Expert, Pro-face Blue 2023-06-22 7.8 High
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious user loads a project file from the local filesystem into the HMI.
CVE-2022-41671 1 Schneider-electric 2 Ecostruxure Operator Terminal Expert, Pro-face Blue 2022-11-08 7.8 High
A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
CVE-2022-41670 1 Schneider-electric 2 Ecostruxure Operator Terminal Expert, Pro-face Blue 2022-11-08 7.8 High
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
CVE-2022-41669 1 Schneider-electric 2 Ecostruxure Operator Terminal Expert, Pro-face Blue 2022-11-08 7.8 High
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
CVE-2022-41668 1 Schneider-electric 2 Ecostruxure Operator Terminal Expert, Pro-face Blue 2022-11-05 7.8 High
A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
CVE-2022-41667 1 Schneider-electric 2 Ecostruxure Operator Terminal Expert, Pro-face Blue 2022-11-05 7.8 High
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
CVE-2022-41666 1 Schneider-electric 2 Ecostruxure Operator Terminal Expert, Pro-face Blue 2022-11-05 7.8 High
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
CVE-2020-28221 1 Schneider-electric 42 Ecostruxure Operator Terminal Expert, Gp-4104g, Gp-4104w and 39 more 2021-02-12 9.8 Critical
A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI.
CVE-2020-7497 1 Schneider-electric 1 Ecostruxure Operator Terminal Expert 2020-06-19 9.8 Critical
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)which could cause arbitrary application execution when the computer starts.
CVE-2020-7495 1 Schneider-electric 1 Ecostruxure Operator Terminal Expert 2020-06-19 5.5 Medium
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) which could cause unauthorized write access outside of expected path folder when opening the project file.
CVE-2020-7494 1 Schneider-electric 1 Ecostruxure Operator Terminal Expert 2020-06-19 7.8 High
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) which could cause malicious code execution when opening the project file.
CVE-2020-7493 1 Schneider-electric 1 Ecostruxure Operator Terminal Expert 2020-06-17 7.8 High
A CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) which could cause malicious code execution when opening the project file.