SEVD-2020-315-02

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Operator Terminal Expert (formerly known as Vijeo XD), Pro-face BLUE and WinGP runtimes. This vulnerability impacts Windows PC and Harmony iPC offers. The EcoStruxure™ Operator Terminal Expert and Pro-face BLUE products are HMI configuration software supporting gestures and UI designs. WinGP is a runtime engine on Windows PC and is included in Pro-face GP-Pro EX product which is an HMI Screen Editor & Logic Programming Software for Pro-face. Failure to apply the remediations provided below may risk unauthorized command execution by a local user of the Windows engineering workstation, which could result in loss of availability, confidentiality and integrity of the workstation where EcoStruxure™ Operator Terminal Expert , Pro-face BLUE or WinGP runtime is installed. January 2021 update: Added Pro-face BLUE and WinGP to the list of products affected and links to the fixes