Lucene search

SchneiderCVE-2022-41667

HistoryNov 04, 2022 - 12:15 p.m.

CVE-2022-41667

2022-11-0412:15:19

CWE-22

schneider

web.nvd.nist.gov

cve-2022-41667

path traversal

cwe-22

ecostruxure operator terminal expert

pro-face blue

nvd

local privilege escalation

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

Affected configurations

Nvd

Node

schneider-electricecostruxure_operator_terminal_expertRange<3.3

schneider-electricecostruxure_operator_terminal_expertMatch3.3

schneider-electricecostruxure_operator_terminal_expertMatch3.3hf1

schneider-electricpro-face_blueRange<3.3

schneider-electricpro-face_blueMatch3.3

schneider-electricpro-face_blueMatch3.3hf1

VendorProductVersionCPE
schneider-electricecostruxure_operator_terminal_expert*cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:*:*:*:*:*:*:*:*
schneider-electricecostruxure_operator_terminal_expert3.3cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:*:*:*:*:*:*:*
schneider-electricecostruxure_operator_terminal_expert3.3cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:hf1:*:*:*:*:*:*
schneider-electricpro-face_blue*cpe:2.3:a:schneider-electric:pro-face_blue:*:*:*:*:*:*:*:*
schneider-electricpro-face_blue3.3cpe:2.3:a:schneider-electric:pro-face_blue:3.3:*:*:*:*:*:*:*
schneider-electricpro-face_blue3.3cpe:2.3:a:schneider-electric:pro-face_blue:3.3:hf1:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	ecostruxure_operator_terminal_expert	*	cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert::::::::
schneider-electric	ecostruxure_operator_terminal_expert	3.3	cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:::::::*
schneider-electric	ecostruxure_operator_terminal_expert	3.3	cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:hf1::::::
schneider-electric	pro-face_blue	*	cpe:2.3:a:schneider-electric:pro-face_blue::::::::
schneider-electric	pro-face_blue	3.3	cpe:2.3:a:schneider-electric:pro-face_blue:3.3:::::::*
schneider-electric	pro-face_blue	3.3	cpe:2.3:a:schneider-electric:pro-face_blue:3.3:hf1::::::

CNA Affected

[
  {
    "vendor": "Schneider Electric",
    "product": "EcoStruxure Operator Terminal Expert",
    "versions": [
      {
        "version": "V3.3",
        "status": "affected",
        "lessThanOrEqual": "Hotfix 1",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Schneider Electric",
    "product": "Pro-face BLUE",
    "versions": [
      {
        "version": "V3.3",
        "status": "affected",
        "lessThanOrEqual": "Hotfix 1",
        "versionType": "custom"
      }
    ]
  }
]

References

www.se.com/ww/en/download/document/SEVD-2022-284-01/

Social References

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

Related for CVE-2022-41667