High

DATE	CVE	VULNERABILITY TITLE	RISK
2023-06-14	CVE-2023-1049	Code Injection vulnerability in Schneider-Electric products A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious user loads a project file from the local filesystem into the HMI. local low complexity schneider-electric CWE-94	7.8
2022-11-04	CVE-2022-41671	Unspecified vulnerability in Schneider-Electric products A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. local low complexity schneider-electric	7.8
2022-11-04	CVE-2022-41670	Unspecified vulnerability in Schneider-Electric products A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. local low complexity schneider-electric	7.8
2022-11-04	CVE-2022-41669	Unspecified vulnerability in Schneider-Electric products A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious DLL which could result in execution of malicious code. local low complexity schneider-electric	7.8
2022-11-04	CVE-2022-41667	Unspecified vulnerability in Schneider-Electric products A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. local low complexity schneider-electric	7.8
2022-11-04	CVE-2022-41668	Unspecified vulnerability in Schneider-Electric products A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. local low complexity schneider-electric	7.8
2022-11-04	CVE-2022-41666	Unspecified vulnerability in Schneider-Electric products A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. local low complexity schneider-electric	7.8