Missing Authentication Vulnerability in IGSS Update Service by Schneider Electric
CVE-2020-7479

7.8HIGH

Key Information:

Vendor
Schneider Electric
Status
Igss (interactive Graphical Scada System) (igss Version Prior To 14.0.0.20009)
Vendor
CVE Published:
23 March 2020

Summary

A vulnerability exists in the IGSS Update Service that stems from missing authentication, allowing local users to execute commands without requiring the necessary escalation of privileges. This weakness can be exploited by sending local network commands, potentially leading to unauthorized actions in the IGSS environment, compromising system integrity and availability.

Affected Version(s)

IGSS (Interactive Graphical SCADA System) (IGSS Version prior to 14.0.0.20009) IGSS (Interactive Graphical SCADA System) (Versions 14 and prior using the service: IGSSupdate)

References

https://www.se.com/ww/en/download/document/SEVD-2020-070-01/
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-20-370/
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.