CVE-2022-24319

CVE-2022-24319 affects ClearSCADA (all versions) and EcoStruxure Geo SCADA Expert 2019/2020 (all versions). The underlying issue is CWE-295: improper certificate validation, enabling a potential Man‑in‑the‑Middle if communications between the client and Geo SCADA web server are intercepted. The a...

CVE-2022-24318

A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure Geo SCADA Expert...

CVE-2022-24318

CVE-2022-24318 affects ClearSCADA (All Versions) and EcoStruxure Geo SCADA Expert 2019/2020. The root cause is CWE-326: Inadequate Encryption Strength, causing non‑encrypted communication with the server when using outdated ViewX clients. The CVSS metrics updated show an attacker‑friendly network...

CVE-2022-24317

A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020 and prior...

CVE-2022-24317

Schneider Electric IGSS Data Server (v15.0.0.22020 and earlier) contains a Missing Authorization vulnerability (CWE-862) that could expose information when a specially crafted message is sent. Multiple sources (CVE records, Red Hat advisory RH:CVE-2022-24317, ZDI-22-324, CNVD-2022-13072, ICSA-22-...

CVE-2022-24316

A CWE-665: Improper Initialization vulnerability exists that could cause information exposure when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020 and prior...

CVE-2022-24316

Schneider Electric IGSS Data Server (IGSSdataServer.exe) is affected by CVE-2022-24316, a CWE-665 Improper Initialization vulnerability (information exposure) in the IGSS Data Server v15.0.0.22020 and prior. Exploitation involves sending a specially crafted message to the server (the vulnerabilit...

CVE-2022-24315

A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020 and prior...

CVE-2022-24315

CVE-2022-24315 is an Out-of-bounds Read vulnerability in Schneider Electric IGSS Data Server (v15.0.0.22020 and earlier) that could cause denial of service when a client repeatedly sends specially crafted messages. Roots cause: memory read past buffer boundary in IGSSDataServer; CVSSv3 base score...

CVE-2022-24314

Schneider Electric IGSS Data Server (Interactive Graphical SCADA System Data Server) affected: v15.0.0.22020 and prior. CVE-2022-24314 is a CWE-125 Out-of-bounds Read vulnerability that can cause memory leaks and potentially denials of service when an attacker sends specially crafted messages. Th...

CVE-2022-24314

A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020 and prior...

CVE-2022-24313

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020...

CVE-2022-24313

CVE-2022-24313 is a stack-based buffer overflow in Schneider Electric IGSS Data Server (IGSSdataServer.exe) affecting v15.0.0.22020 and earlier. The vulnerability arises from copying user-supplied data into a fixed-size stack buffer, enabling remote code execution. Public advisories describe expl...

CVE-2022-24312

Schneider Electric IGSS Data Server (IGSSdataServer.exe) v15.0.0.22020 and earlier is affected by CVE-2022-24312, a CWE-22 path traversal vulnerability that could allow modification of existing files or creation of new files in the Data Server context, potentially enabling remote code execution w...

CVE-2022-24311

Schneider Electric IGSS Data Server (v15.0.0.22020 and earlier) includes a CWE-22 path traversal vulnerability that can modify an existing file or create a new one in the Data Server context, potentially enabling remote code execution when a specially crafted message is sent. The Red Hat/ICSA adv...

CVE-2022-24311

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by inserting at beginning of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends...

CVE-2022-24312

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a...

CVE-2022-24310

A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote code execution when an attacker sends multiple specially crafted messages. Affected Product: Interactive Graphical SCADA System Data Serv...

CVE-2022-24310

CVE-2022-24310 affects Schneider Electric IGSS Data Server (v15.0.0.22020 and prior). Root cause: CWE-190 integer overflow/wraparound that can cause a heap-based buffer overflow, enabling denial of service and potentially remote code execution when processing multiple specially crafted messages. ...

Interactive Graphical SCADA System Data Server 缓冲区错误漏洞

The Schneider Electric Interactive Graphical Scada System is a Scada system for monitoring industrial processes from Schneider Electric, France. An out-of-bounds read vulnerability exists in the Schneider Electric Interactive Graphical Scada System, which can be exploited by an attacker to cause ...