CVE-2023-1049
High
Description
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious user loads a project file from the local filesystem into the HMI.
SeverityHigh
CVSS7.8
Exploit probability49. percentile0.6%
ProductSchneider-electric Ecostruxure Operator Terminal Expert
PublishedJun 14, 2023
First seenJun 14, 2023
Weakness typeCWE-94Code injection
How to fix
Update
- schneider-electric ecostruxure_operator_terminal_expert3.3 or later
- schneider-electric pro-face_blue3.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric ecostruxure_operator_terminal_expert | v < 3.3, 3.3 | 3.3 |
| schneider-electric pro-face_blue | v < 3.3, 3.3 | 3.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.