Improper Limitation of Pathname Vulnerability in Schneider Electric's Custom Reports
CVE-2023-27981

7.8HIGH

Key Information:

Vendor
Schneider Electric
Status
Igss Data Server(igssdataserver.exe)
Igss Dashboard (dashboard.exe)
Custom Reports (rms16.dll)
Vendor
CVE Published:
21 March 2023

Summary

A security vulnerability exists in Schneider Electric's Custom Reports that may allow an attacker to execute arbitrary code on the affected systems. This issue stems from improper limitation of pathnames leading to the potential exploitation when users attempt to open specially crafted malicious reports. The products susceptible to this vulnerability include IGSS Data Server, IGSS Dashboard, and Custom Reports, specifically versions 16.0.0.23040 and earlier.

Affected Version(s)

Custom Reports (RMS16.dll) V <= 16.0.0.23040

IGSS Dashboard (DashBoard.exe) V <= 16.0.0.23040

IGSS Data Server(IGSSdataServer.exe) V <= 16.0.0.23040

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.