CVE-2022-41668

Name of the Vulnerable Software and Affected Versions EcoStruxure Operator Terminal Expert versions prior to V3.3 Hotfix 1 Pro-face BLUE versions prior to V3.3 Hotfix 1

Description The issue is related to incorrect project conversion, which can be exploited to execute malicious code. An adversary with local user privileges can load a project file from a controlled network share, potentially leading to the execution of arbitrary code.

Recommendations For EcoStruxure Operator Terminal Expert versions prior to V3.3 Hotfix 1, update to a version later than V3.3 Hotfix 1. For Pro-face BLUE versions prior to V3.3 Hotfix 1, update to a version later than V3.3 Hotfix 1. As a temporary workaround, consider restricting access to project files from untrusted network shares to minimize the risk of exploitation.