Description
A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to remote code execution when a user opens a malicious report file planted by an attacker. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | IGSS Data Server(IGSSdataServer.exe) | V – ≤ 16.0.0.23040 | — |
| Schneider Electric | IGSS Dashboard (DashBoard.exe) | V – ≤ 16.0.0.23040 | — |
| Schneider Electric | Custom Reports (RMS16.dll) | V – ≤ 16.0.0.23040 | — |
Advisories 2
- ICSA-23-082-04 Schneider Electric IGSS CISA ICS & IT advisories · Apr 3, 2023
- SEVD-2023-073-04 IGSS (Interactive Graphical SCADA System) Schneider Electric CPCERT · Mar 14, 2023