Schneider Electric IGSS SCADA Software

🗓️ 11 Mar 2021 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 49 Views

Schneider Electric IGSS SCADA Software version 15.0.0.21041 and prior is prone to improper restriction of operations within the bounds of a memory buffer, allowing remote code execution. Critical infrastructure sectors affected are commercial facilities, critical manufacturing, and energy. Worldwide deployment. Mitigations provided by Schneider Electric. Kimiya, working with Trend Micro’s Zero Day Initiative, reported the vulnerabilities to CISA

Reporter	Title	Published	Views	Family All 47
BDU FSTEC	The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System (IGSS), arises from operations that go beyond the buffer boundaries in memory, allowing attackers to read or write arbitrary files.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System (IGSS), arises from operations that go beyond the buffer boundaries in memory, allowing attackers to execute arbitrary code.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System (IGSS), arises from operations that go beyond the buffer boundaries in memory, allowing attackers to read or write arbitrary files.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System (IGSS), arises from operations that go beyond the buffer boundaries in memory, allowing attackers to execute arbitrary code.	30 Mar 202100:00	–	bdu_fstec
Circl	CVE-2021-22709	12 Mar 202100:54	–	circl
Circl	CVE-2021-22710	12 Mar 202100:54	–	circl
Circl	CVE-2021-22711	12 Mar 202100:54	–	circl
Circl	CVE-2021-22712	12 Mar 202100:54	–	circl
CNNVD	Schneider Electric Interactive Graphical SCADA System 缓冲区错误漏洞	11 Mar 202100:00	–	cnnvd
CNNVD	Schneider Electric Interactive Graphical SCADA System 缓冲区错误漏洞	11 Mar 202100:00	–	cnnvd

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-070-01.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-21-070-01
us-cert	www.us-cert.cisa.gov/ncas/tips/ST04-014
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
us-cert	www.us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B

11 Mar 2021 00:00Current

8.4High risk

Vulners AI Score8.4

CVSS 3.17.8

CVSS 29.3

EPSS0.007