CVE-2020-7478

2020-03-2319:17:11

CWE-22

schneider

www.cve.org

0.045 Low

EPSS

Percentile

92.5%

JSON

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update Service is enabled.

CNA Affected

[
  {
    "product": "IGSS (Interactive Graphical SCADA System) (IGSS Version prior to 14.0.0.20009)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "IGSS (Interactive Graphical SCADA System) (Versions 14 and prior using the service: IGSSupdate)"
      }
    ]
  }
]