Lucene search

SchneiderCVE-2022-41670

HistoryNov 04, 2022 - 2:15 p.m.

CVE-2022-41670

2022-11-0414:15:10

CWE-22

schneider

web.nvd.nist.gov

cve-2022-41670

sgiutility

path traversal

local privileges

dll

execution

ecostruxure operator terminal expert

pro-face blue

nvd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

Affected configurations

Nvd

Node

schneider-electricecostruxure_operator_terminal_expertRange<3.3

schneider-electricecostruxure_operator_terminal_expertMatch3.3-

schneider-electricecostruxure_operator_terminal_expertMatch3.3hotfix1

schneider-electricpro-face_blueRange<3.3

schneider-electricpro-face_blueMatch3.3-

schneider-electricpro-face_blueMatch3.3hotfix1

VendorProductVersionCPE
schneider-electricecostruxure_operator_terminal_expert*cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:*:*:*:*:*:*:*:*
schneider-electricecostruxure_operator_terminal_expert3.3cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:-:*:*:*:*:*:*
schneider-electricecostruxure_operator_terminal_expert3.3cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:hotfix1:*:*:*:*:*:*
schneider-electricpro-face_blue*cpe:2.3:a:schneider-electric:pro-face_blue:*:*:*:*:*:*:*:*
schneider-electricpro-face_blue3.3cpe:2.3:a:schneider-electric:pro-face_blue:3.3:-:*:*:*:*:*:*
schneider-electricpro-face_blue3.3cpe:2.3:a:schneider-electric:pro-face_blue:3.3:hotfix1:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	ecostruxure_operator_terminal_expert	*	cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert::::::::
schneider-electric	ecostruxure_operator_terminal_expert	3.3	cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:-::::::
schneider-electric	ecostruxure_operator_terminal_expert	3.3	cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:hotfix1::::::
schneider-electric	pro-face_blue	*	cpe:2.3:a:schneider-electric:pro-face_blue::::::::
schneider-electric	pro-face_blue	3.3	cpe:2.3:a:schneider-electric:pro-face_blue:3.3:-::::::
schneider-electric	pro-face_blue	3.3	cpe:2.3:a:schneider-electric:pro-face_blue:3.3:hotfix1::::::

CNA Affected

[
  {
    "vendor": "Schneider Electric",
    "product": "EcoStruxure Operator Terminal Expert",
    "versions": [
      {
        "version": "V3.3",
        "status": "affected",
        "lessThanOrEqual": "Hotfix 1",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Schneider Electric",
    "product": "Pro-face BLUE",
    "versions": [
      {
        "version": "V3.3",
        "status": "affected",
        "lessThanOrEqual": "Hotfix 1",
        "versionType": "custom"
      }
    ]
  }
]

References

www.se.com/ww/en/download/document/SEVD-2022-284-01/

Social References

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

Related for CVE-2022-41670