CVE-2022-41670 — Schneider Electric / EcoStruxure Operator Terminal Expert

Description (CNA)

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

Affected (CNA)

Vendor / product	Versions
Schneider Electric / EcoStruxure Operator Terminal Expert	affected V3.3 through Hotfix 1
Schneider Electric / Pro-face BLUE	affected V3.3 through Hotfix 1

CWE

CWE-22

References

https://www.se.com/ww/en/download/document/SEVD-2022-284-01/

ADP enrichment

CVE

No English description supplied.

https://www.se.com/ww/en/download/document/SEVD-2022-284-01/

CISA-ADP

No English description supplied.

No references supplied.