Summary
Schneider Electric is aware of a vulnerability in its IGSS Definition module for the IGSS (Interactive Graphical
SCADA System) product.
The [IGSS](https://igss.schneider-electric.com/) product is a state-of-the-art SCADA system used for monitoring and controlling industrial processes.
The IGSS Definition module is a design-time component used by system integrators to create mimic diagrams for plant personnel, enabling them to monitor and control the SCADA system.
Failure to apply the remediation provided below may risk loss of data or arbitrary code execution, which could result in the loss of control of the system.
Vulnerabilities 1
-
High 8.4
CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execu…
Revision history
-
#2
Initial CISA Republication of Schneider Electric SEVD-2026-195-01 advisory
-
#1
Original Release
References
-
Out-of-Bounds Write vulnerability in IGSS - SEVD-2026-195-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-195-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-195-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/ww/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-26-211-04 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-04
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b