Description
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update Service is enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | IGSS (Interactive Graphical SCADA System) (IGSS Version prior to 14.0.0.20009) | IGSS (Interactive Graphical SCADA System) (Versions 14 and prior using the service: IGSSupdate) | — |
Advisories 2
- ICSA-20-084-02 Schneider Electric IGSS SCADA Software CISA ICS & IT advisories · Mar 24, 2020
- SEVD-2020-070-01 IGSS (Interactive Graphical SCADA System) Schneider Electric CPCERT · Mar 10, 2020