VYPR
← All advisories
High severity7.0NVD Advisory· Published Nov 4, 2022· Updated Jun 17, 2026

CVE-2022-41671

CVE-2022-41671

Description

A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

Affected products

10
  • Schneider Electric/Ecostruxure Operator Terminal Expert4 versions
    cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:*:*:*:*:*:*:*:*range: <3.3
    • cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:-:*:*:*:*:*:*
    • cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:hotfix1:*:*:*:*:*:*
    • (no CPE)range: V3.3
  • Schneider Electric/Pro Face Blue4 versions
    cpe:2.3:a:schneider-electric:pro-face_blue:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:schneider-electric:pro-face_blue:*:*:*:*:*:*:*:*range: <3.3
    • cpe:2.3:a:schneider-electric:pro-face_blue:3.3:-:*:*:*:*:*:*
    • cpe:2.3:a:schneider-electric:pro-face_blue:3.3:hotfix1:*:*:*:*:*:*
    • (no CPE)range: V3.3
  • EcoStruxure/Operator Terminal Expertllm-create
    Range: <=V3.3 Hotfix 1
  • Pro Face/BLUEllm-create
    Range: <=V3.3 Hotfix 1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.