Summary
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Operator Terminal Expert and Pro-face BLUE products.
The EcoStruxure™ Operator Terminal Expert and Pro-face BLUE products are HMI configuration software supporting gestures and UI designs.
Failure to apply the remediations provided below may risk unauthorized code execution by a local user of the Windows engineering workstation, which could result in loss of availability, integrity, and confidentiality of the workstation where EcoStruxure™ Operator Terminal Expert or Pro-face BLUE runtime is installed.
Vulnerabilities 6
-
High 7.0
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local use…
-
High 7.0
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allo…
-
High 7.0
A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load…
-
High 7.0
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allow…
-
High 7.0
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SG…
-
High 7.0
A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that a…
Revision history
-
#1
Original Release
References
-
EcoStruxure™ Operator Terminal Expert and Pro-face BLUE - SEVD-2022-284-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-284-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-284-01_EcoStruxure_Operator_Terminal_Expert_and_Pro-face_BLUE_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/