CVE-2023-27980

Published Mar 21, 2023

Last updated 2 years ago

Overview

Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious report file in the IGSS project report directory, this could lead to remote code execution when a victim eventually opens the report. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior)
Source: cybersecurity@se.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cybersecurity@se.com: CWE-306

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:schneider-electric:custom_reports:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "93DB1B65-C1B5-4A20-ACA7-84EE9C07E9B1",
            "versionEndIncluding": "16.0.0.23040"
          },
          {
            "criteria": "cpe:2.3:a:schneider-electric:igss_dashboard:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CCB39F06-042F-444C-819B-709FF63E060F",
            "versionEndIncluding": "16.0.0.23040"
          },
          {
            "criteria": "cpe:2.3:a:schneider-electric:igss_data_server:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AE9B5271-999B-4B2B-B4F3-8D99B3A78077",
            "versionEndIncluding": "16.0.0.23040"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References