CVE-2022-24321

CVE-2022-24321 is reported as a CWE-754 vulnerability causing Denial of Service to the Geo SCADA server when receiving malformed HTTP requests. Affected products include ClearSCADA (all versions) and EcoStruxure Geo SCADA Expert 2019 and 2020 (all versions). The connected documents confirm the ro...

CVE-2022-24321

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADA server when receiving a malformed HTTP request. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure Geo...

CVE-2022-24320

CVE-2022-24320 describes a vulnerability in the TLS/certificate handling that could enable a Man-in-the-Middle attack on communications between Geo SCADA clients and the Geo SCADA database server. Affected products include ClearSCADA (all versions) and EcoStruxure Geo SCADA Expert 2019 (all versi...

CVE-2022-24320

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA database server are intercepted. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure G...

CVE-2022-24319

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure Geo...

CVE-2022-24319

CVE-2022-24319 affects ClearSCADA (all versions) and EcoStruxure Geo SCADA Expert 2019/2020 (all versions). The underlying issue is CWE-295: improper certificate validation, enabling a potential Man‑in‑the‑Middle if communications between the client and Geo SCADA web server are intercepted. The a...

CVE-2022-24318

A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure Geo SCADA Expert...

CVE-2022-24318

CVE-2022-24318 affects ClearSCADA (All Versions) and EcoStruxure Geo SCADA Expert 2019/2020. The root cause is CWE-326: Inadequate Encryption Strength, causing non‑encrypted communication with the server when using outdated ViewX clients. The CVSS metrics updated show an attacker‑friendly network...

CVE-2022-24317

A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020 and prior...

CVE-2022-24317

Schneider Electric IGSS Data Server (v15.0.0.22020 and earlier) contains a Missing Authorization vulnerability (CWE-862) that could expose information when a specially crafted message is sent. Multiple sources (CVE records, Red Hat advisory RH:CVE-2022-24317, ZDI-22-324, CNVD-2022-13072, ICSA-22-...

CVE-2022-24316

Schneider Electric IGSS Data Server (IGSSdataServer.exe) is affected by CVE-2022-24316, a CWE-665 Improper Initialization vulnerability (information exposure) in the IGSS Data Server v15.0.0.22020 and prior. Exploitation involves sending a specially crafted message to the server (the vulnerabilit...

CVE-2022-24316

A CWE-665: Improper Initialization vulnerability exists that could cause information exposure when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020 and prior...

CVE-2022-24315

CVE-2022-24315 is an Out-of-bounds Read vulnerability in Schneider Electric IGSS Data Server (v15.0.0.22020 and earlier) that could cause denial of service when a client repeatedly sends specially crafted messages. Roots cause: memory read past buffer boundary in IGSSDataServer; CVSSv3 base score...

CVE-2022-24315

A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020 and prior...

CVE-2022-24314

Schneider Electric IGSS Data Server (Interactive Graphical SCADA System Data Server) affected: v15.0.0.22020 and prior. CVE-2022-24314 is a CWE-125 Out-of-bounds Read vulnerability that can cause memory leaks and potentially denials of service when an attacker sends specially crafted messages. Th...

CVE-2022-24314

A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020 and prior...

CVE-2022-24313

CVE-2022-24313 is a stack-based buffer overflow in Schneider Electric IGSS Data Server (IGSSdataServer.exe) affecting v15.0.0.22020 and earlier. The vulnerability arises from copying user-supplied data into a fixed-size stack buffer, enabling remote code execution. Public advisories describe expl...

CVE-2022-24313

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020...

CVE-2022-24311

Schneider Electric IGSS Data Server (v15.0.0.22020 and earlier) includes a CWE-22 path traversal vulnerability that can modify an existing file or create a new one in the Data Server context, potentially enabling remote code execution when a specially crafted message is sent. The Red Hat/ICSA adv...

CVE-2022-24311

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by inserting at beginning of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends...