CVE-2022-41670 Path traversal in EcoStruxure Operator Terminal Expert
Local attackers can exploit a path traversal flaw to load malicious DLLs and execute arbitrary code in Schneider Electric HMI software.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-41670?
CVE-2022-41670 is a high-severity path traversal vulnerability in Schneider Electric EcoStruxure Operator Terminal Expert, published on 4 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
Weakness: CWE-22
Which versions are affected by CVE-2022-41670?
It affects 2 products.
Products include Schneider-Electric Ecostruxure Operator Terminal Expert, Schneider-Electric Pro-Face Blue.
How do I fix CVE-2022-41670?
No fix has been published for CVE-2022-41670 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-41670 being exploited?
There is no known exploitation of CVE-2022-41670 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric EcoStruxure Operator Terminal Expert
- CVE-2020-28221 Code injection in EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series
- CVE-2020-7497 Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)
- CVE-2023-1049 Code injection in EcoStruxure™ Operator Terminal Expert
- CVE-2020-7493 SQL injection in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)
- CVE-2020-7494 Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)
Sources
Also known as GHSA-fx46-8pxx-3pfj.