Summary
Schneider Electric is aware of multiple vulnerabilities in its Data Server module for the IGSS (Interactive Graphical SCADA System) product.
The IGSS product is a SCADA system used for monitoring and controlling industrial processes. The Data Server is a module with a TCP interface used by other modules to access data of the SCADA System.
Failure to apply the remediation provided below may result in denial of service and data files in the IGSS Report folder being lost, added, changed, or exposed. Further, it may risk remote code execution, which could result in various issues, including disclosure of data and loss of control of the SCADA System with IGSS running in production mode.
The CVE-2022-32528 description details have been clarified (page 2).
Vulnerabilities 8
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
Critical 9.8
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
High 8.6
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and …
Revision history
-
#2.1.0
The CVE-2022-32528 description details have been clarified (page 2).
-
#2.0.0
The affected versions have been updated to include versions up to V15.0.0.22170.
-
#1.0.0
Original Release
References
-
IGSS (Interactive Graphical SCADA System) - SEVD-2022-165-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-165-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-01_IGSS_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/