Missing Authentication Vulnerability in IGSS Data Server by Schneider Electric
CVE-2023-27980

8.8HIGH

Key Information:

Vendor

Schneider Electric
Status
Igss Data Server(igssdataserver.exe)
Igss Dashboard (dashboard.exe)
Custom Reports (rms16.dll)
Vendor
CVE Published:
21 March 2023

What is CVE-2023-27980?

A missing authentication vulnerability exists in the TCP interface of the IGSS Data Server, allowing unauthorized users to create a malicious report file within the IGSS project report directory. If a victim opens this report, it may lead to remote code execution, compromising system integrity and security. Affected versions include IGSS Data Server V16.0.0.23040 and earlier, IGSS Dashboard V16.0.0.23040 and earlier, and Custom Reports V16.0.0.23040 and earlier.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Custom Reports (RMS16.dll) V <= 16.0.0.23040

IGSS Dashboard (DashBoard.exe) V <= 16.0.0.23040

IGSS Data Server(IGSSdataServer.exe) V <= 16.0.0.23040

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.