CVE-2013-0657

CVE-2013-0657 affects Schneider Electric IGSS (Interactive Graphical SCADA System) up to v10, where a stack-based buffer overflow on crafted input to TCP port 12397/12399 can lead to remote arbitrary code execution. The root cause is a buffer overflow in the DC.exe component (port 12397/tcp) trig...

CVE-2019-6827

CVE-2019-6827 describes an Out-of-bounds Write (CWE-787) in Schneider Electric’s Interactive Graphical SCADA System (IGSS) , affected in versions 14 and earlier. The vulnerability arises from improper handling of the mdb database data (UnitIdx/BaseUnits), which can cause a software crash and, per...

CVE-2021-22759

CVE-2021-22759 is a use-after-free vulnerability (CWE-416) in Schneider Electric IGSS Definition (Def.exe) up to version 15.0.0.21140. The Red Hat and NVD/NVD-sourced materials describe that unchecked input data when importing a malicious CGF file into IGSS Definition can lead to data loss or rem...

CVE-2020-7558

The CVE-2020-7558 entry concerns Schneider Electric IGSS Definition (Def.exe) version 14.0.0.20247 with an Out-of-bounds Write (CWE-787) that can lead to Remote Code Execution when a malicious CGF file is imported. Public sources (ZDI advisory and Red Hat/NVD/NVD-derived records) confirm the affe...

CVE-2020-7556

The CVE-2020-7556 issue affects Schneider Electric IGSS Definition (Def.exe) 14.0.0.20247. It is an out-of-bounds write (CWE-787) in the CGF file parsing that could lead to remote code execution when a malicious CGF is imported. Public details indicate a high-severity vulnerability (CVSS v3 base ...

CVE-2021-22709

The CVE-2021-22709 entry affects Schneider Electric IGSS Definition (Def.exe) up to version 15.0.0.21041. The root cause is a CWE-119 buffer handling issue in parsing CGF configuration files, allowing loss of data or remote code execution when a malicious CGF is imported. Affected product: IGSS D...

CVE-2021-22710

The CVE-2021-22710 issue affects Schneider Electric IGSS Definition (Def.exe) prior to version 15.0.0.21042. It is a CWE-119 buffer-bounds vulnerability in the CGF file parsing that could allow remote code execution when a malicious CGF file is imported. The root cause is improper handling/valida...

CVE-2020-7552

CVE-2020-7552 affects Schneider Electric IGSS Definition (Def.exe) up to version 14.0.0.20247. The issue is a CGF file parsing heap-based buffer overflow that could lead to remote code execution. ZDI details indicate the flaw exists in parsing CGF files, enabling code execution in the current pro...

CVE-2021-22712

Schneider Electric IGSS Def.exe (Definition) has a CWE-119 buffer bounds vulnerability in V15.0.0.21041 and earlier, allowing arbitrary read/write via parsing a malicious CGF file due to an unchecked pointer address. ZDI reports remote code execution with user interaction required (visit a malici...

CVE-2022-32526

CVE-2022-32526 affects Schneider Electric IGSS Data Server (IGSSdataServer.exe) prior to version 15.0.0.22170. The vulnerability is a CWE-120 buffer copy/stack-based overflow, triggered by specially crafted setting value messages, with potential remote code execution. Exploitation status is not d...

CVE-2020-7550

CVE-2020-7550 affects Schneider Electric IGSS Definition (Def.exe) >=14.0.0.20247. The issue is an improper restriction of operations within the bounds of a memory buffer during CGF file parsing, leading to remote code execution when a malicious CGF is imported. The root cause is a stack-based...

CVE-2020-7554

Schneider Electric IGSS exposes CVE-2020-7554, a CWE-119 buffer-boundary vulnerability in IGSS Definition (Def.exe) 14.0.0.20247 that can lead to Remote Code Execution when a malicious CGF file is imported. The Red Hat/Red Hat-affiliated and ZDI entries describe a stack-based or related boundary ...

CVE-2021-22762

Affected product: Schneider Electric IGSS Definition (Def.exe) version 15.0.0.21140 and earlier. Root cause: CWE-22 Improper Restriction of a Pathname to a Restricted Directory during parsing of CGF/WSP files, enabling remote code execution. Impact: remote code execution with the same user contex...

CVE-2023-4516

Schneider Electric IGSS Update Service (v16.0.0.23211 and earlier) is affected by CVE-2023-4516: a CWE-306 missing authentication for a critical function vulnerability that lets a local attacker change the update source, potentially enabling remote code execution when a malicious update is applie...

CVE-2021-22761

The CVE-2021-22761 entry applies to Schneider Electric IGSS Definition (Def.exe) versions 15.0.0.21140 and earlier. The root cause is missing length checks when parsing a malicious CGF file, leading to out-of-bounds/memory corruption that can disclose information or enable remote code execution. ...

CVE-2022-32524

CVE-2022-32524 affects Schneider Electric IGSS Data Server (IGSSdataServer.exe) prior to version 15.0.0.22170. The root cause is a CWE-120: Buffer Copy without Checking Size of Input, leading to a stack-based buffer overflow. This could enable remote code execution when an attacker sends speciall...

CVE-2020-7478

CVE-2020-7478 is a directory traversal vulnerability in Schneider Electric IGSS IGSSupdateservice (versions 14 and prior, using the IGSSupdate service). The flaw allows a remote unauthenticated attacker to read arbitrary files on the IGSS server over the network when the update service is enabled...

CVE-2021-22758

IGSS Definition (Def.exe) vulnerability CVE-2021-22758 affects v15.0.0.21140 and earlier, caused by lack of input validation when importing a malicious CGF file, leading to loss of data or remote code execution (CWE-824). Schneider Electric fixes this in Def.exe v15.0.0.21141; remediation guidanc...

CVE-2020-7553

Schneider Electric IGSS Def.exe (IGSS Definition) versions affected include 14.0.0.20247 and earlier. A CWE-787 Out-of-bounds Write vulnerability in CGF file parsing could allow Remote Code Execution when a malicious CGF is imported to IGSS Definition. Public details describe a heap-based buffer ...

CVE-2020-7555

Schneider Electric IGSS suffers CWE-787 out-of-bounds write in IGSS Definition (Def.exe) 14.0.0.20247 and earlier, enabling remote code execution when a malicious CGF file is imported. Exploitation requires user interaction (e.g., opening a malicious file/page). Remediation: update to IGSS 14.0.0...

CVE-2020-7557

Schneider Electric IGSS Definition (Def.exe) 14.0.0.20247 contains a CWE-125 Out-of-bounds Read that could lead to Remote Code Execution when a malicious CGF file is imported. The issue stems from parsing CGF data and impacts IGSS Definition components responsible for that import path. ZDI confir...

CVE-2021-22711

Schneider Electric IGSS Definition (Def.exe) vulnerabilities CVE-2021-22711 and related CVEs affect version 15.0.0.21041 and earlier, due to improper validation when importing CGF files, causing memory read/write and potential memory corruption. The ZDI advisory identifies a remote-code-execution...

CVE-2022-32523

CVE-2022-32523 affects IGSS Data Server (IGSSdataServer.exe) prior to version 15.0.0.22170. It is a CWE-120 buffer copy without checking input size, causing a stack-based buffer overflow that could enable remote code execution when handling specially crafted online data request messages. Referenc...

CVE-2017-9967

Affected product: Schneider Electric IGSS SCADA Software (version 12 and earlier). Root cause: security misconfiguration of memory protection (ASLR and DEP) leading to weak security. Impact: vulnerability described as a local, likely code-execution risk when exploiting improper security configura...

CVE-2020-7551

Schneider Electric IGSS exposes an out-of-bounds write in the IGSS Definition module (Def.exe) version 14.0.0.20247 when parsing a malicious CGF file, allowing Remote Code Execution. The vulnerability (CWE-787) affects Def.exe; exploitation requires user interaction (e.g., opening a malicious CGF...

CVE-2021-22750

The CVE-2021-22750 issue affects Schneider Electric IGSS Definition (Def.exe) versions up to 15.0.0.21041 (and earlier) with an out-of-bounds write when importing a malicious CGF file, caused by missing length checks. The vulnerability can lead to data loss or remote code execution on affected sy...

CVE-2017-6033

Schneider Electric IGSS (Interactive Graphical SCADA System) Software Versions 12 and earlier are affected by a DLL Hijacking vulnerability (CVE-2017-6033) due to Uncontrolled Search Path Element (CWE-427). The issue arises when a malicious DLL with the same name as a legitimate file is placed in...

CVE-2022-32522

The CVE-2022-32522 entry affects Schneider Electric IGSS Data Server (IGSSdataServer.exe) and is caused by a CWE-120 Buffer Copy without Checking Size of Input. The vulnerability is a stack-based buffer overflow that could enable remote code execution when an attacker sends specially crafted math...

CVE-2020-7479

Schneider Electric IGSS (Interactive Graphical SCADA System) IGSSupdate service versions 14 and prior are affected by CVE-2020-7479 (Missing Authentication for Critical Function). The vulnerability enables a local user to execute processes requiring elevated privileges when sending local network ...

CVE-2021-22754

CVE-2021-22754 is an out-of-bounds write vulnerability in Schneider Electric’s IGSS Definition (Def.exe) up to version 15.0.0.21140. The issue arises from insufficient validation during parsing/import of a malicious CGF file, potentially leading to data loss or remote code execution. Red Hat and ...

CVE-2021-22753

The CVE-2021-22753 vulnerability affects Schneider Electric IGSS Definition (Def.exe) v15.0.0.21140 and earlier, caused by missing length checks when parsing malicious WSP files, leading to a CWE-125 out-of-bounds read that could result in data loss or remote code execution. Schneider Electric fi...

CVE-2021-22757

The connected Red Hat and Schneider Electric disclosures confirm CVE-2021-22757 affects Schneider Electric IGSS Definition (Def.exe) versions 15.0.0.21140 and earlier. The root cause is an out-of-bounds read (CWE-125) stemming from insufficient input validation when importing a malicious CGF file...

CVE-2022-32529

CVE-2022-32529 affects IGSS Data Server (IGSSdataServer.exe) prior to V15.0.0.22170. Description: CWE-120 Buffer Copy without Checking Size of Input leads to a stack-based buffer overflow that could enable remote code execution when processing specially crafted log data request messages. Affected...

CVE-2022-2329

Schneider Electric IGSS Data Server (IGSSdataServer.exe) is affected by a CWE-190 integer overflow in versions prior to V15.0.0.22073, leading to a heap-based buffer overflow that could cause denial of service and potentially remote code execution when handling specially crafted messages. Affecte...

CVE-2022-32527

The PT-2022-3182 and related records confirm CVE-2022-32527 affects Schneider Electric IGSS Data Server (IGSSdataServer.exe) with a CWE-120 vulnerability: a buffer copy without checking input size causes a stack-based overflow that could enable remote code execution via crafted alarm cache data m...

CVE-2022-32528

The CVE-2022-32528 entry concerns Schneider Electric IGSS Data Server (IGSSdataServer.exe) prior to version V15.0.0.22170. The issue is a CWE-306 Missing Authentication for Critical Function vulnerability that could allow an attacker to manipulate and read files in the IGSS project report directo...

CVE-2021-22755

The connected sources confirm CVE-2021-22755 affects Schneider Electric IGSS Definition (Def.exe) up to version 15.0.0.21140, with an out-of-bounds write vulnerability arising from insufficient validation/sanity checks when importing a CGF file. Impact is disclosure of information or remote code ...

CVE-2021-22756

CVE-2021-22756 affects Schneider Electric IGSS Definition (Def.exe) versions up to 15.0.0.21140. The Red Hat and CNVD/NVD entries describe an out-of-bounds read (CWE-125) caused by insufficient validation when a malicious CGF file is imported, potentially enabling information disclosure or remote...

CVE-2021-22760

CVE-2021-22760 affects Schneider Electric IGSS Definition (Def.exe) v15.0.0.21140 and earlier, with a CWE-763 release of invalid pointer or reference due to missing checks of user-supplied input when importing a malicious CGF file. Impact could include data loss or remote code execution. Schneide...

CVE-2021-22751

Affected software : IGSS Definition (Def.exe) versions up to 15.0.0.21140 and earlier. Vulnerability : CWE-787 out-of-bounds write when importing a malicious CGF file, caused by insufficient input validation, potentially leading to information disclosure or arbitrary code execution. Impacted scen...

CVE-2021-22752

CVE-2021-22752 concerns Schneider Electric IGSS Definition (Def.exe) up to v15.0.0.21140. It is a CWE-787 out-of-bounds write vulnerability arising from missing size checks while parsing WSP files, potentially enabling data loss or remote code execution in affected IGSS Definition. The NVD and mu...

CVE-2022-32525

The CVE-2022-32525 vulnerability affects Schneider Electric IGSS Data Server (IGSSdataServer.exe) prior to v15.0.0.22170. It is described as a CWE-120 buffer copy without checking input size, leading to a stack-based buffer overflow when processing alarm data messages. This could enable remote co...

CVE-2022-24324

CVE-2022-24324 affects Schneider Electric IGSS Data Server (IGSSdataServer.exe) prior to v15.0.0.22073. Root cause is a CWE-120 buffer copy without checking input size, leading to a stack-based buffer overflow and potential remote code execution when a specially crafted message is received. Affec...