CVE-2022-41670 — Path Traversal in Ecostruxure Operator Terminal Expert

CWE-22 — Path Traversal3 documents3 sources
Severity
7.8HIGHNVD
CNA7.0
EPSS
0.1%
top 83.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Schneider-electric Ecostruxure Operator Terminal ExpertSchneider-electric Pro-face BlueSchneider Electric Ecostruxure Operator Terminal Expert+1 more
Timeline
PublishedNov 4

Description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5schneider_electric/pro-face_blueV3.3 — Hotfix 1

Patches

Patch: www.se.com ↗Patch: www.se.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-fx46-8pxx-3pfj: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows↗2022-11-04
▶
CVEList
CVE-2022-41670: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows↗2022-11-04
▶
CVE-2022-41670 — Path Traversal | cvebase