The vulnerability of the Custom Reports component of the SCADA system’s data server, as well as the monitoring tools of the Custom Reports and IGSS Dashboards, allows a perpetrator to execute arbitrary code.

🗓️ 23 Mar 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

Custom Reports and monitoring tools allow code execution from a crafted file due to weak input verification.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2023-27984	21 Mar 202313:34	–	circl
CNNVD	Schneider Electric IGSS Data Server 输入验证错误漏洞	21 Mar 202300:00	–	cnnvd
CNVD	Schneider Electric IGSS Data Server Input Validation Error Vulnerability	20 Mar 202300:00	–	cnvd
CVE	CVE-2023-27984	21 Mar 202300:00	–	cve
Cvelist	CVE-2023-27984	21 Mar 202300:00	–	cvelist
EUVD	EUVD-2023-31710	3 Oct 202520:07	–	euvd
ICS	Schneider Electric IGSS	3 Apr 202319:38	–	ics
NVD	CVE-2023-27984	21 Mar 202311:15	–	nvd
OSV	CVE-2023-27984	21 Mar 202311:15	–	osv
Prion	Input validation	21 Mar 202311:15	–	prion

Vulners

Node

schneider_electric igss_data_serverRange≤16.0.0.23040

OR

schneider_electric igss_dashboardRange≤16.0.0.23040

OR

schneider_electric custom_reportsRange≤16.0.0.23040

Source	Link
download	www.download.schneider-electric.com/files
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2023032025
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-23-341/
web	www.web.nvd.nist.gov/view/vuln/detail
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-23-341/

23 Mar 2023 00:00Current

7.8High risk

Vulners AI Score7.8

CVSS 27.2

CVSS 37.8

EPSS0.00609

Custom Reports Monitoring Tools Data Server Input Verification Crafted File Arbitrary Code Execution Scada System Code Execution