CVE-2022-41670

published 2022-11-04

CVE-2022-41670: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows…

high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	ecostruxure_operator_terminal_expert	< 3.3	3.3
schneider-electric	ecostruxure_operator_terminal_expert	—	—
schneider-electric	pro-face_blue	< 3.3	3.3
schneider-electric	pro-face_blue	—	—
schneider_electric	ecostruxure_operator_terminal_expert	V3.3 – Hotfix 1	—
schneider_electric	pro-face_blue	V3.3 – Hotfix 1	—

CWE-22