CVE-2023-1049 — Code Injection in Ecostruxure Operator Terminal Expert

CWE-94 — Code InjectionCWE-1049 — Excessive Data Query Operations in a Large Data TableCWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 68.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Schneider-electric Ecostruxure Operator Terminal ExpertSchneider-electric Pro-face BlueSchneider Electric Ecostruxure Operator Terminal Expert+1 more
Timeline
PublishedJun 14
Latest updateSep 27

Description

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious user loads a project file from the local filesystem into the HMI.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5schneider_electric/pro-face_blue3.3 SP1 and prior

🔴Vulnerability Details

3
GHSA
Pimcore Demo Allows GraphQL Introspection↗2023-09-27
▶
GHSA
GHSA-63c6-hm8j-v6m9: A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspic↗2023-06-14
▶
CVEList
CVE-2023-1049: A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspic↗2023-06-14
▶
CVE-2023-1049 — Code Injection | cvebase