Pro-face BLUE vulnerabilities
7 known vulnerabilities in Pro-face BLUE from Schneider Electric. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.8 High severity
EcoStruxure™ Operator Terminal Expert: Improper Control of Generation of Code
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious user loads a project file from the local filesystem into the HMI.
- 7.8 High severity
EcoStruxure Operator Terminal Expert: Improper Neutralization of Special Elements used in an SQL Command
A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in ex
- 7.8 High severity
EcoStruxure Operator Terminal Expert: Improper Limitation of a Pathname to a Restricted Directory
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code
- 7.8 High severity
EcoStruxure Operator Terminal Expert: Improper Verification of Cryptographic Signature
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious DLL which could result in execution of malicious code. Affected Products: EcoStr
- 7.8 High severity
EcoStruxure Operator Terminal Expert: Incorrect Type Conversion or Cast
A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure
- 7.8 High severity
EcoStruxure Operator Terminal Expert: Improper Limitation of a Pathname to a Restricted Directory
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStru
- 7.8 High severity
EcoStruxure Operator Terminal Expert: Improper Verification of Cryptographic Signature
A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert