A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker to change update source, potentially leading to remote code execution when the attacker force an update containing malicious content.

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker to change update source, potentially leading to remote code execution when the attacker force an update containing malicious content.

A deserialization of untrusted data vulnerability that could cause an interpretation of malicious payload data exists in the Dashboard module, which could lead to arbitrary code execution if an attacker gets the user to open a malicious file. A missing authentication for critical function vulnerability that could allow a local attacker to change the update source exists in the IGSS Update Service, which could lead to remote code execution the attacker force an update containing malicious content.

Schneider Electric is aware of ​a vulnerability​ in its ​Update Service for the IGSS​ (Interactive Graphical SCADA System) product. The IGSS product is a state-of-the art SCADA system used for monitoring and controlling industrial processes. The IGSS Update Service handles IGSS Software to be updated. Failure to apply the remediation provided below may risk ​remote code execution​, which could result in a variety of issues including loss of control of the SCADA System with IGSS running in production mode