A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file.

A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file.

A deserialization of untrusted data vulnerability that could cause an interpretation of malicious payload data exists in the Dashboard module, which could lead to arbitrary code execution if an attacker gets the user to open a malicious file. A missing authentication for critical function vulnerability that could allow a local attacker to change the update source exists in the IGSS Update Service, which could lead to remote code execution the attacker force an update containing malicious content.

Schneider Electric is aware of a vulnerability in its Dashboard module for the IGSS (Interactive Graphical SCADA System) product. The IGSS product is a SCADA system used for monitoring and controlling industrial processes. The Dashboard access data of the SCADA System to be presented. Failure to apply the remediation provided below may risk remote code execution, which could result in a variety of issues including loss of control of the SCADA System with IGSS running in production mode.