CVE-2022-41670

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Schneider Electric	EcoStruxure Operator Terminal Expert	>= V3.3, <= Hotfix 1
Schneider Electric	Pro-face BLUE	>= V3.3, <= Hotfix 1

References

https://www.se.com/ww/en/download/document/SEVD-2022-284-01/Patch, Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2022-284-01/Patch, Vendor Advisory

Timeline

Published: Nov 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-416717.8A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries wit CVE-2022-416728.1In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue us CVE-2022-416748.1An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80 CVE-2022-416758.0A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users CVE-2022-416765.4Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can sen CVE-2022-416775.3An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve informati CVE-2022-416788.8Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jet CVE-2022-416796.1Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject java CVE-2022-416806.5Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allo CVE-2022-416818.8There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to pri CVE-2022-416845.5A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD CVE-2022-416858.8Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and