PT-2022-6533 · Schneider Electric · Ecostruxure Operator Terminal Expert+1

Published 2022-10-11 · Updated 2022-11-08 · CVE-2022-41670

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EcoStruxure Operator Terminal Expert versions V3.3 Hotfix 1 or prior Pro-face BLUE versions V3.3 Hotfix 1 or prior

Description A path traversal vulnerability exists in the SGIUtility component, allowing adversaries with local user privileges to load malicious DLL, which could result in execution of malicious code.

Recommendations For EcoStruxure Operator Terminal Expert versions V3.3 Hotfix 1 or prior, consider disabling the SGIUtility component until a patch is available. For Pro-face BLUE versions V3.3 Hotfix 1 or prior, restrict access to the SGIUtility component to minimize the risk of exploitation. As a temporary workaround, avoid using the SGIUtility component in the affected products until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-02122

CVE-2022-41670

Affected Products

Ecostruxure Operator Terminal Expert

Pro-Face Blue

References · 7

• https://bdu.fstec.ru/vul/2023-02122 · Security Note
• https://se.com/ww/en/download/document/SEVD-2022-284-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41670 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41670 · Security Note
• https://vuldb.com/ru/?id.212977 · Note
• https://t.me/cvenotify/37290 · Telegram Post
• https://t.me/cibsecurity/52564 · Telegram Post