CVE-2022-41670
Last modified
CVE-2022-41670 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Schneider-Electric | Ecostruxure Operator Terminal Expert | < 3.3 |
| Schneider-Electric | Ecostruxure Operator Terminal Expert | 3.3 |
| Schneider-Electric | Pro-Face Blue | < 3.3 |
| Schneider-Electric | Pro-Face Blue | 3.3 |
References
- https://www.se.com/ww/en/download/document/SEVD-2022-284-01/Patch, Vendor Advisory
- https://www.se.com/ww/en/download/document/SEVD-2022-284-01/Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-41670?
How severe is CVE-2022-41670?
How do I fix CVE-2022-41670?
Are you affected by CVE-2022-41670?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST