Description
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious report file in the IGSS project report directory, this could lead to remote code execution when a victim eventually opens the report. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | IGSS Data Server(IGSSdataServer.exe) | V – ≤ 16.0.0.23040 | — |
| Schneider Electric | IGSS Dashboard (DashBoard.exe) | V – ≤ 16.0.0.23040 | — |
| Schneider Electric | Custom Reports (RMS16.dll) | V – ≤ 16.0.0.23040 | — |
Advisories 2
- ICSA-23-082-04 Schneider Electric IGSS CISA ICS & IT advisories · Apr 3, 2023
- SEVD-2023-073-04 IGSS (Interactive Graphical SCADA System) Schneider Electric CPCERT · Mar 14, 2023