Schneider Electric IGSS SCADA Software

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: IGSS Interactive Graphical SCADA System Vulnerabilities: Path Traversal, Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of...

CVE-2020-7478

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update...

CVE-2020-7479

A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the IGSS Update Service...

CVE-2020-7478

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update...

CVE-2020-7479

A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the IGSS Update Service...

Design/Logic Flaw

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update...

CVE-2020-7478

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update...

CVE-2020-7479

A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the IGSS Update Service...

CVE-2020-7479

Schneider Electric IGSS (Interactive Graphical SCADA System) IGSSupdate service versions 14 and prior are affected by CVE-2020-7479 (Missing Authentication for Critical Function). The vulnerability enables a local user to execute processes requiring elevated privileges when sending local network ...

CVE-2020-7478

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update...

CVE-2020-7478

CVE-2020-7478 is a directory traversal vulnerability in Schneider Electric IGSS IGSSupdateservice (versions 14 and prior, using the IGSSupdate service). The flaw allows a remote unauthenticated attacker to read arbitrary files on the IGSS server over the network when the update service is enabled...

Schneider Electric IGSS MDB Database BaseUnits UnitIdx Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric IGSS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within use of the...

CVE-2019-6827

A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System IGSS, Version 14 and prior, which could cause a software crash when data in the mdb database is manipulated...

Out-of-bounds

A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System IGSS, Version 14 and prior, which could cause a software crash when data in the mdb database is manipulated...

CVE-2019-6827

A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System IGSS, Version 14 and prior, which could cause a software crash when data in the mdb database is manipulated...

CVE-2019-6827

CVE-2019-6827 describes an Out-of-bounds Write (CWE-787) in Schneider Electric’s Interactive Graphical SCADA System (IGSS) , affected in versions 14 and earlier. The vulnerability arises from improper handling of the mdb database data (UnitIdx/BaseUnits), which can cause a software crash and, per...

Schneider Electric Interactive Graphical SCADA System

1. EXECUTIVE SUMMARY CVSS v3 7.0 Vendor: Schneider Electric Equipment: Interactive Graphical SCADA System IGSS Vulnerability: Out-of-Bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve arbitrary code execution or crash the software. 3...

PT-2019-5999 · Igss · Igss

Name of the Vulnerable Software and Affected Versions: Interactive Graphical SCADA System IGSS versions prior to 14 Description: The issue is related to an out-of-bounds write in the memory, which can be triggered by manipulating data in the mdb database. This can cause a software crash,...

7-Technologies IGSS Remote Memory Corruption

Overview ICS-CERT has become aware of a memory corruption vulnerability that has been coordinated with 7-Technologies 7T by the VUPEN Vulnerability Research Team. 7T has created a patch that fully resolves this vulnerability. VUPEN has confirmed that the patch resolves the vulnerability. 7T has...

7-Technologies IGSS Denial of Service (Update A)

Overview ICS-CERT has become aware of multiple denial-of-service DoS vulnerabilities in the 7-Technologies 7T Interactive Graphical SCADA System IGSS supervisory control and data acquisition SCADA human-machine interface HMI application. All vulnerabilities are remotely exploitable. 7T has...