High severity · published Nov 4, 2022
CVE-2022-41670
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EO
EcoStruxure Operator Terminal Expert · Schneider Electric
V3.3 through Hotfix 1 · source: vendor, NVD
PB
Pro-face BLUE · Schneider Electric
V3.3 through Hotfix 1 · source: vendor, NVD
Affected product
EO
EcoStruxure Operator Terminal Expert
Schneider Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-41670
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-41670
Patch
https://www.se.com/ww/en/download/document/SEVD-2022-284-01/
More from EcoStruxure Operator Terminal Expert
9.8
CVE-2020-28221
A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause…
9.8
CVE-2020-7497
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior…
7.8
CVE-2023-1049
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious user loads a project…
7.8
CVE-2022-41667
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privileges to load a…
7.8
CVE-2022-41669
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious…