Summary
Schneider Electric is aware of a vulnerability in Harmony/Magelis iPC Series HMI, Vijeo Designer and Vijeo Designer Basic.
The Harmony/Magelis iPC Series HMI products are configured by Vijeo Designer software.
Vijeo Designer and Vijeo Designer Basic are software solutions for developing, configuring, and commissioning an entire machine in a single software environment.
Failure to apply the remediations provided below may risk unauthorized access to the base installation directory due to improper access control lists, which could result in local privilege escalation.
Vulnerabilities 1
-
Unscored —
A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installa…
Revision history
-
#1
Original release
References
-
Harmony/Magelis iPC Series HMI, Vijeo Designer and Vijeo Designer Basic - SEVD-2022-039-06 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-06
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/