CVE-2022-41668

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-704

Affected software

Vendor	Product	Versions
Schneider Electric	EcoStruxure Operator Terminal Expert	>= V3.3, <= Hotfix 1
Schneider Electric	Pro-face BLUE	>= V3.3, <= Hotfix 1

References

https://www.se.com/ww/en/download/document/SEVD-2022-284-01/Patch, Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2022-284-01/Patch, Vendor Advisory

Timeline

Published: Nov 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-416697.8A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with lo CVE-2022-41677.5Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 CVE-2022-416707.8A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component th CVE-2022-416717.8A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries wit CVE-2022-416728.1In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue us CVE-2022-416748.1An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80 CVE-2022-416758.0A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users CVE-2022-416765.4Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can sen CVE-2022-416775.3An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve informati CVE-2022-416788.8Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jet CVE-2022-416796.1Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject java CVE-2022-416806.5Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allo