Insufficient Data Verification in Schneider Electric IGSS Data Server

CVE-2023-27977

Summary

The vulnerability identified in Schneider Electric's IGSS Data Server originates from inadequate verification of data authenticity. This flaw can be exploited by attackers to send carefully crafted messages to the Data Server's TCP port, allowing unauthorized access to delete critical files within the IGSS project report directory. Such actions can result in significant data loss and compromise the integrity of user operations. Affected products include the IGSS Data Server, IGSS Dashboard, and Custom Reports, all of which are vulnerable up to version 16.0.0.23040.

References