A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Operator Terminal Expert and Pro-face BLUE products. The EcoStruxure™ Operator Terminal Expert and Pro-face BLUE products are HMI configuration software supporting gestures and UI designs. Failure to apply the remediations provided below may risk unauthorized code execution by a local user of the Windows engineering workstation, which could result in loss of availability, integrity, and confidentiality of the workstation where EcoStruxure™ Operator Terminal Expert or Pro-face BLUE runtime is installed.