Description
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that
could cause execution of malicious code when an unsuspicious user loads a project file from the
local filesystem into the HMI.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure™ Operator Terminal Expert | 3.3 SP1 and prior | — |
| Schneider Electric | Pro-face BLUE | 3.3 SP1 and prior | — |
Advisories 2
- ICSA-23-180-02 Schneider Electric EcoStruxure Operator Terminal Expert CISA ICS & IT advisories · Jun 29, 2023
- SEVD-2023-164-01 EcoStruxure™ Operator Terminal Expert and Pro-face BLUE Schneider Electric CPCERT · Jun 13, 2023