VYPR
← All advisories
High severity7.8NVD Advisory· Published Jun 14, 2023· Updated Jun 17, 2026

CVE-2023-1049

CVE-2023-1049

Description

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious user loads a project file from the local filesystem into the HMI.

Affected products

8
  • Schneider Electric/HMIllm-fuzzy
  • Schneider Electric/Ecostruxure Operator Terminal Expert4 versions
    cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:*:*:*:*:*:*:*:*range: <3.3
    • cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:-:*:*:*:*:*:*
    • cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.3:sp1:*:*:*:*:*:*
    • (no CPE)range: 3.3 SP1 and prior
  • Schneider Electric/Pro Face Blue3 versions
    cpe:2.3:a:schneider-electric:pro-face_blue:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:schneider-electric:pro-face_blue:*:*:*:*:*:*:*:*range: <3.3
    • cpe:2.3:a:schneider-electric:pro-face_blue:3.3:-:*:*:*:*:*:*
    • cpe:2.3:a:schneider-electric:pro-face_blue:3.3:sp1:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.