CVE-2022-41666

CWE-3473 documents3 sources
Severity
7.8HIGH
EPSS
0.0%
top 92.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Schneider-electric Ecostruxure Operator Terminal ExpertSchneider-electric Pro-face BlueSchneider Electric Ecostruxure Operator Terminal Expert+1 more
Timeline
PublishedNov 4

Description

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5schneider_electric/pro-face_blueV3.3 — Hotfix 1

🔴Vulnerability Details

2
CVEList
CVE-2022-41666: A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a maliciou↗2022-11-04
▶
GHSA
GHSA-9fmw-xp57-phr3: A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a maliciou↗2022-11-04
▶
CVE-2022-41666 (HIGH CVSS 7.8) | A CWE-347: Improper Verification of | cvebase.io