VYPR
← All advisories
High severity7.0NVD Advisory· Published Nov 4, 2022· Updated Jun 17, 2026

CVE-2022-41668

CVE-2022-41668

Description

A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

Affected products

10
  • Schneider Electric/Ecostruxure Operator Terminal Expert4 versions
    cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:*:*:*:*:*:*:*:*range: <3.3
    • cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:hf1:*:*:*:*:*:*
    • (no CPE)range: V3.3
  • Schneider Electric/Pro Face Blue4 versions
    cpe:2.3:a:schneider-electric:pro-face_blue:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:schneider-electric:pro-face_blue:*:*:*:*:*:*:*:*range: <3.3
    • cpe:2.3:a:schneider-electric:pro-face_blue:3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:schneider-electric:pro-face_blue:3.3:hf1:*:*:*:*:*:*
    • (no CPE)range: V3.3
  • Pro Face/BLUEllm-create
    Range: <=V3.3 Hotfix 1
  • EcoStruxure/Operator Terminal Expertllm-create
    Range: <=V3.3 Hotfix 1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.