Path Traversal Vulnerability in EcoStruxure Operator Terminal Expert and Pro-face BLUE by Schneider Electric

CVE-2022-41670

What is CVE-2022-41670?

A path traversal vulnerability exists in the SGIUtility component of selected Schneider Electric products, allowing adversaries with local user privileges to manipulate file paths. By exploiting this flaw, attackers can load and execute malicious DLL files, compromising system integrity. This issue primarily affects EcoStruxure Operator Terminal Expert and Pro-face BLUE versions prior to V3.3 Hotfix 1, necessitating immediate attention and remediation for affected users.

References