CVE-2022-41670

published 2022-11-04

CVE-2022-41670: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows…

Priority P3 40 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	ecostruxure_operator_terminal_expert	< 3.3	3.3
schneider-electric	ecostruxure_operator_terminal_expert	—	—
schneider-electric	pro-face_blue	< 3.3	3.3
schneider-electric	pro-face_blue	—	—
schneider_electric	ecostruxure_operator_terminal_expert	V3.3 – Hotfix 1	—
schneider_electric	pro-face_blue	V3.3 – Hotfix 1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22