Lucene search

[email protected]CVE-2021-22757

HistoryJun 11, 2021 - 4:15 p.m.

CVE-2021-22757

2021-06-1116:15:09

CWE-125

[email protected]

web.nvd.nist.gov

cve-2021-22757

cwe-125

igss definition

def.exe

vulnerability

disclosure of information

remote code execution

input data

cgf file

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.4%

JSON

A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote code execution due to lack of sanity checks on user-supplied input data, when a malicious CGF file is imported to IGSS Definition.

Affected configurations

NVD

Node

schneider-electricinteractive_graphical_scada_systemRange≤15.0.0.21140

CPENameOperatorVersion
schneider-electric:interactive_graphical_scada_systemschneider-electric interactive graphical scada systemle15.0.0.21140

CPE	Name	Operator	Version
schneider-electric:interactive_graphical_scada_system	schneider-electric interactive graphical scada system	le	15.0.0.21140

CNA Affected

[
  {
    "product": "IGSS Definition (Def.exe) V15.0.0.21140 and prior",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "IGSS Definition (Def.exe) V15.0.0.21140 and prior"
      }
    ]
  }
]

References

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01

Social References

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.4%

JSON

Related for CVE-2021-22757

nvd1 cvelist1 prion1 ics1