Summary
Successful exploitation of these vulnerabilities could result in a denial-of-service condition, as well as the loss, addition, or modification of dashboards or report files in the IGSS Report folder. Successful exploitation of these vulnerabilities could also allow remote code execution, potentially resulting in loss of control of the supervisory control and data acquisition (SCADA) System with IGSS running in production mode.
Vulnerabilities 8
-
High 8.8
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that coul…
-
High 8.8
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause mani…
-
High 7.8
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpret…
-
High 7.8
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could…
-
High 7.8
A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, pot…
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause acce…
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the …
-
Medium 6.5
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that coul…
Revision history
-
#1
CSAF Creation Date
References
-
ICS Advisory ICSA-23-082-04 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-04
-
Recommended Practices
https://us-cert.cisa.gov/ics/Recommended-Practices
-
Recommended Practices
https://cisa.gov/ics