Skip to content
OpenAdvisories
Critical SEVD-2021-285-03 4 CVEs

IGSS (Interactive Graphical SCADA System)

Published Oct 12, 2021 · Updated Oct 12, 2021

Vendor: Schneider Electric Product: IGSS Data Collector (dc.exe)

Summary

Schneider Electric is aware of multiple vulnerabilities in its Data Collector module for IGSS (Interactive Graphical SCADA System) product.
The IGSS product is a state-of-the art SCADA system used for monitoring and controlling industrial processes. IGSS communicates with all major industry standard PLC drivers.
Failure to apply the remediations provided below may risk remote code execution, which in worst case could result in an attacker gaining access to the Windows Operating System on the machine running IGSS in production.

Vulnerabilities 4

  • Unscored —
    CVE-2021-22802 EPSS 20%

    A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution d…

  • Unscored —
    CVE-2021-22803

    A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code executio…

  • Unscored —
    CVE-2021-22804

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure …

  • Unscored —
    CVE-2021-22805

    A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary fil…

Revision history

  1. #1.0.0

    Original Release

References