CVE-2020-28221 Code injection in EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series
Improper input validation in EcoStruxure and Pro-face HMI software allows arbitrary code execution when the Ethernet Download feature is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-28221?
CVE-2020-28221 is a critical code injection vulnerability in EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series, published on 25 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI.
Weakness: CWE-20
Which versions are affected by CVE-2020-28221?
It affects 2 products.
Products include Schneider-Electric Ecostruxure Operator Terminal Expert, Schneider-Electric Pro-Face Blue.
How do I fix CVE-2020-28221?
No fix has been published for CVE-2020-28221 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-28221 being exploited?
There is no known exploitation of CVE-2020-28221 in the wild and no public exploit code.
Other vulnerabilities in EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series
- CVE-2020-7497 Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)
- CVE-2023-1049 Code injection in EcoStruxure™ Operator Terminal Expert
- CVE-2020-7493 SQL injection in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)
- CVE-2020-7494 Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)
- CVE-2022-41666 Security feature bypass in EcoStruxure Operator Terminal Expert
Sources
Also known as GHSA-rv39-23hm-r9j8.