Improper input validation in EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A…
Priority MEDIUM 46CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI.
Why it matters now
EPSS 0.02139 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series | EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series | — | No fix listed | CNA |
- EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series Vendor— Affected EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series Fixed in — No fix listed CNA
CPE configurations NVD · 44
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:sp1a:*:*:*:*:*:* | 3.1 sp1a | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmi_sto_501:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmi_sto_511:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmi_sto_512:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmi_sto_531:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmi_sto_532:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmig3u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmig3x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmig5u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
- cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:ecostruxure_operator_terminal_expert:3.1:sp1a:*:*:*:*:*:* Versions 3.1 sp1a Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmi_sto_501:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmi_sto_511:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmi_sto_512:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmi_sto_531:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmi_sto_532:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmig3u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmig3x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmig5u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
Show 34 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:schneider-electric:hmig5u2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmist6200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmist6400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmist6500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmist6600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmist6700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:a:schneider-electric:pro-face_blue:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:pro-face_blue:3.1:sp1a:*:*:*:*:*:* | 3.1 sp1a | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:gp-4104g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:gp-4104w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:gp-4105g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:gp-4105w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:gp-4106g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:gp-4106w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:gp-4107g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:gp-4107w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5400wa:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5500tp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5500wa:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5600ta:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5600tp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5600wa:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5660tp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5700tp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5700wc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5800wc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5b00:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5b10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:sp-5b41:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:st-6200wa:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:st-6400wa:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:st-6500wa:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:st-6600wa:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:st-6700wa:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
- cpe:2.3:h:schneider-electric:hmig5u2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmist6200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmist6400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmist6500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmist6600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmist6700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:a:schneider-electric:pro-face_blue:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:pro-face_blue:3.1:sp1a:*:*:*:*:*:* Versions 3.1 sp1a Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:gp-4104g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:gp-4104w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:gp-4105g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:gp-4105w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:gp-4106g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:gp-4106w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:gp-4107g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:gp-4107w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5400wa:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5500tp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5500wa:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5600ta:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5600tp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5600wa:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5660tp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5700tp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5700wc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5800wc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5b00:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5b10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:sp-5b41:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:st-6200wa:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:st-6400wa:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:st-6500wa:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:st-6600wa:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:st-6700wa:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-28221
- 2026-10-03 Alias added: GHSA-rv39-23hm-r9j8
References
More Schneider Electric Ecostruxure Operator Terminal Expert vulnerabilities
- TI-2020-06020 Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior CVSS 3.1CRITICAL 9.8
- TI-2023-00994 Code injection in Schneider Electric EcoStruxure™ Operator Terminal Expert CVSS 3.1HIGH 7.8
- TI-2020-06017 Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior CVSS 3.1HIGH 7.8
- TI-2022-20066 SQL injection in Schneider Electric EcoStruxure Operator Terminal Expert CVSS 3.1HIGH 7.8
- TI-2022-20062 Path traversal in Schneider Electric EcoStruxure Operator Terminal Expert CVSS 3.1HIGH 7.8
- TI-2020-06016 SQL injection in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior CVSS 3.1HIGH 7.8
Sources
- CVE-2020-28221 · CVE Program
- CVE-2020-28221 · NVD
- FIRST EPSS
- GHSA-rv39-23hm-r9j8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences