Arbitrary Code Execution Vulnerability in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE

CVE-2020-28221 · CRITICAL Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI.

Learn more about our Web Application Penetration Testing UK.