Summary
Schneider Electric is aware of multiple vulnerabilities in its Data Collector module for the IGSS (Interactive Graphical SCADA System) product.
The IGSS product is a state-of-the art SCADA system used for monitoring and controlling industrial processes. IGSS communicates with all major industry standard PLC drivers.
Failure to apply the remediations provided below may risk loss of data or denial of service, which in worst case could result in problems controlling the SCADA System from the machine running IGSS in production.
Vulnerabilities 2
-
Unscored —CVE-2021-22823 EPSS 21%
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary fil…
-
Unscored —CVE-2021-22824 EPSS 14%
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in denial of service, due …
Revision history
-
#1.0.0
Original Release
References
-
IGSS (Interactive Graphical SCADA System) - SEVD-2021-348-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-348-01_IGSS_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/