CVE-2023-1049

Name of the Vulnerable Software and Affected Versions Schneider Electric EcoStruxure Operator Terminal Expert (affected versions not specified) Pro-face BLUE (affected versions not specified)

Description A code injection vulnerability exists, potentially allowing the execution of malicious code when a user loads a project file from the local filesystem into the HMI. This issue is related to improper control of code generation and could enable an attacker to execute arbitrary code by loading a specially crafted project file.

Recommendations For Schneider Electric EcoStruxure Operator Terminal Expert, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Pro-face BLUE, at the moment, there is no information about a newer version that contains a fix for this vulnerability.