Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior
Priority LOW 27CWE-22Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) which could cause unauthorized write access outside of expected path folder when opening the project file.
Why it matters now
EPSS 0.00906 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) | EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) | — | No fix listed | CNA |
- EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) Vendor— Affected EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:*:*:*:*:*:*:*:* | up to 3.0 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:-:*:*:*:*:*:* | 3.1 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:sp1:*:*:*:*:*:* | 3.1 sp1 | Vulnerable | Schneider Electric |
- cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:*:*:*:*:*:*:*:* Versions up to 3.0 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:-:*:*:*:*:*:* Versions 3.1 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:sp1:*:*:*:*:*:* Versions 3.1 sp1 Vulnerable ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7495
- 2026-10-03 Alias added: GHSA-gjhf-3jpp-hgj2
References
More Schneider Electric Ecostruxure Operator Terminal Expert vulnerabilities
- TI-2020-06020 Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior CVSS 3.1CRITICAL 9.8
- TI-2020-17151 Improper input validation in EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A… CVSS 3.1CRITICAL 9.8
- TI-2023-00994 Code injection in Schneider Electric EcoStruxure™ Operator Terminal Expert CVSS 3.1HIGH 7.8
- TI-2020-06017 Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior CVSS 3.1HIGH 7.8
- TI-2022-20066 SQL injection in Schneider Electric EcoStruxure Operator Terminal Expert CVSS 3.1HIGH 7.8
- TI-2022-20062 Path traversal in Schneider Electric EcoStruxure Operator Terminal Expert CVSS 3.1HIGH 7.8
Sources
- CVE-2020-7495 · CVE Program
- CVE-2020-7495 · NVD
- FIRST EPSS
- GHSA-gjhf-3jpp-hgj2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences