Lucene search

SchneiderCVE-2022-32522

HistoryJan 30, 2023 - 11:15 p.m.

CVE-2022-32522

2023-01-3023:15:10

CWE-120

schneider

web.nvd.nist.gov

cve-2022-32522

nvd

igss data server

buffer overflow

remote code execution

vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.004

Percentile

75.3%

JSON

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted mathematically reduced data request messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170)

Affected configurations

Nvd

Node

schneider-electricinteractive_graphical_scada_systemRange≤15.0.0.22170

VendorProductVersionCPE
schneider-electricinteractive_graphical_scada_system*cpe:2.3:a:schneider-electric:interactive_graphical_scada_system:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	interactive_graphical_scada_system	*	cpe:2.3:a:schneider-electric:interactive_graphical_scada_system::::::::

CNA Affected

[
  {
    "vendor": "Schneider Electric",
    "product": "IGSS Data Server (IGSSdataServer.exe)",
    "versions": [
      {
        "version": "All",
        "status": "affected",
        "lessThan": "V15.0.0.22170",
        "versionType": "custom"
      }
    ]
  }
]

References

download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-01_IGSS_Security_Notification_V2.pdf

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.004

Percentile

75.3%

JSON

Related for CVE-2022-32522