CVE-2023-1049: Schneider Electric Ecostruxure Operator Terminal Expert

High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious user loads a project file from the local filesystem into the HMI.

Affected products

• Schneider Electric Ecostruxure Operator Terminal Expert: before 3.3 (fixed in 3.3); version 3.3 only
• Schneider Electric Pro-Face Blue: before 3.3 (fixed in 3.3); version 3.3 only

Published 2023-06-14. Last modified 2026-06-17.