Summary
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Operator Terminal Expert and Pro-face BLUE products.
The EcoStruxure™ Operator Terminal Expert and Pro-face BLUE products are HMI configuration software supporting gestures and UI designs.
Failure to apply the remediation provided below may risk unauthorized code execution by a local user of the Windows engineering workstation, which could result in loss of availability, confidentiality, and integrity of the workstation where EcoStruxure™ Operator Terminal Expert or Pro-face BLUE runtime is installed.
Vulnerabilities 1
-
High 7.8
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of …
Revision history
-
#1
Original Release
References
-
EcoStruxure™ Operator Terminal Expert and Pro-face BLUE - SEVD-2023-164-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/