Most recent entries from all

bdu:2023-02899

certfr-2021-avi-772 — De multiples vulnérabilités ont été découvertes dans les produits Schneider. Certaines d'entre elles permettent à un at…

certfr-2021-avi-772

EUVD-2026-23141

fkie_cve-2021-22803

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths, when an attacker, writes arbitrary files to folders in context of the DC module, by sending constructed messages on the network. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)

GHSA-9qgp-r53f-2gwm

gsd-2021-22803

ICSA-21-285-03 — Schneider Electric IGSS

The affected product is vulnerable to remote code execution, due to missing length check on user supplied data, when a constructed message is received on the network.CVE-2021-22802 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By sending constructed messages on the network, an attacker could write arbitrary files to folders in context of the DC module that could lead to remote code execution.CVE-2021-22803 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An issue exists that could allow disclosure and read access of arbitrary files in the context of the user running IGSS, due to missing validation of user supplied data in network messages.CVE-2021-22804 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). An issue exists that could allow disclosure and read access of arbitrary files in the context of the user running IGSS, due to missing validation of user supplied data in network messages.CVE-2021-22805 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

SEVD-2021-285-03 — IGSS (Interactive Graphical SCADA System)

Schneider Electric is aware of multiple vulnerabilities in its Data Collector module for IGSS (Interactive Graphical SCADA System) product. The IGSS product is a state-of-the art SCADA system used for monitoring and controlling industrial processes. IGSS communicates with all major industry standard PLC drivers. Failure to apply the remediations provided below may risk remote code execution, which in worst case could result in an attacker gaining access to the Windows Operating System on the machine running IGSS in production.