Description
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update
Service that could allow a local attacker to change update source, potentially leading to remote
code execution when the attacker force an update containing malicious content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | IGSS Update Service (IGSSupdateservice.exe) | v16.0.0.23211 and prior | — |
Advisories 2
- ICSA-23-220-01 Schneider Electric IGSS CISA ICS & IT advisories · Oct 12, 2023
- SEVD-2023-255-01 IGSS (Interactive Graphical SCADA System) Schneider Electric CPCERT · Sep 12, 2023