Description
A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the IGSS Update Service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | IGSS (Interactive Graphical SCADA System) (IGSS Version prior to 14.0.0.20009) | IGSS (Interactive Graphical SCADA System) (Versions 14 and prior using the service: IGSSupdate) | — |
Advisories 2
- ICSA-20-084-02 Schneider Electric IGSS SCADA Software CISA ICS & IT advisories · Mar 24, 2020
- SEVD-2020-070-01 IGSS (Interactive Graphical SCADA System) Schneider Electric CPCERT · Mar 10, 2020