CVE Vulnerabilities

CVE-2022-41666

Improper Verification of Cryptographic Signature

Published: Nov 04, 2022 | Modified: Nov 05, 2022
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

Weakness

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Software

Name Vendor Start Version End Version
Ecostruxure_operator_terminal_expert Schneider-electric * 3.3 (excluding)
Ecostruxure_operator_terminal_expert Schneider-electric 3.3 (including) 3.3 (including)
Pro-face_blue Schneider-electric * 3.3 (excluding)
Pro-face_blue Schneider-electric 3.3 (including) 3.3 (including)

References