Privilege escalation

A CWE-269 Improper Privilege Management vulnerability exists in EcoStruxureª Operator Terminal Expert runtime Vijeo XD that could cause privilege escalation on the workstation when interacting directly with a driver installed by the runtime software of EcoStruxureª Operator Terminal Expert...

CVE-2020-7544

CVE-2020-7544 affects Schneider Electric EcoStruxure Operator Terminal Expert runtime (Vijeo XD). A CWE-269 improper privilege management vulnerability could enable privilege escalation on a workstation when interacting with a driver installed by the runtime. The vulnerability is reported for Eco...

Schneider Electric EcoStruxure Operator Terminal Expert Permission License and Access Control Issues Vulnerability

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is primarily used to create and edit touch applications. EcoStruxure Operator Terminal Expert suffers from a privilege license and access control...

The vulnerability of the software for configuring Schneider Electric EcoStruxure Operator Terminal Expert, related to incorrect processing of VXDZ files, allows a perpetrator to execute arbitrary code.

The vulnerability of Schneider Electric EcoStruxure Operator Terminal Expert software for configuring touchscreen displays is related to improper handling of VXDZ files. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially crafted file or website...

CVE-2020-7494

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause malicious code execution when opening the project file...

CVE-2020-7493

A CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause malicious code execution when opening the project file...

CVE-2020-7494

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause malicious code execution when opening the project file...

CVE-2020-7497

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XDwhich could cause arbitrary application execution when the computer starts...

CVE-2020-7495

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause unauthorized write access outside of expected pa...

Sql injection

A CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause malicious code execution when opening the project file...

Path traversal

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause malicious code execution when opening the project file...

CVE-2020-7497

The CVE-2020-7497 entry concerns a Path Traversal (CWE-22) vulnerability in Schneider Electric EcoStruxure Operator Terminal Expert (O Te) 3.1 Service Pack 1 and earlier (formerly Vijeo XD) that could cause arbitrary application execution when the computer starts. Affected component: the OT Exper...

CVE-2020-7496

The CVE-2020-7496 entry applies to Schneider Electric EcoStruxure Operator Terminal Expert (3.1 Service Pack 1 and prior, formerly Vijeo XD). The vulnerability is CWE-88: Argument Injection or Modification, which could enable unauthorized write access when opening a project file. Red Hat and NVD ...

CVE-2020-7495

Schneider Electric EcoStruxure Operator Terminal Expert (OTE) — CVE-2020-7495: A path traversal in ZIP file extraction affects OTE 3.1 Service Pack 1 and earlier (formerly Vijeo XD). The flaw allows writing outside the intended folder when opening a project file, enabling unauthorized writes. Evi...

CVE-2020-7494

EcoStruxure Operator Terminal Expert (Schneider Electric) vulnerable through CVE-2020-7494 (Path Traversal) in version 3.1 Service Pack 1 and earlier. Affects handling of project files and can lead to code execution within the current process when opening a malicious project file. Red Hat/RedTeam...

CVE-2020-7493

The CVE-2020-7493 issue affects Schneider Electric EcoStruxure Operator Terminal Expert (3.1 Service Pack 1 and earlier, formerly Vijeo XD). The vulnerability is a SQL Injection (CWE-89) in handling project files that can lead to code execution when opening a crafted project file. Public sources ...

Schneider Electric EcoStruxure Operator Terminal Expert Path Traversal Vulnerability

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A path traversal vulnerability exists in Schneider Electric EcoStruxure Operator...

Schneider Electric EcoStruxure Operator Terminal Expert

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Low skill level to exploit/public exploits are available Vendor: Schneider Electric Equipment: EcoStruxure Operator Terminal Expert Vulnerabilities: SQL Injection, Path Traversal, Argument Injection 2. RISK EVALUATION Successful exploitation of these...

Schneider Electric EcoStruxure Operator Terminal Expert Path Traversal Vulnerability (CNVD-2020-37620)

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A path traversal vulnerability exists in the processing of ZIP files in Schneider...

Schneider Electric EcoStruxure Operator Terminal Expert SQL Injection Vulnerability

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A SQL injection vulnerability exists in the handling of VXDZ files in Schneider Electr...