IGSS Definition (Def.exe) version 14.0.0.20247 and prior
At a glance
- Source
- NVD
- EPSS
- EPSS 2.49 % · percentile 85 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- schneider
- NVD status
- Modified
Description
A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 and prior that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
Weaknesses (CWE)
- CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-28675
- GCVE · GCVE-0-2020-7550
CERT-FR advisories
- CERTFR-2020-AVI-726 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:schneider-electric:interactive_graphical_scada_system:*:*:*:*:*:*:*:*≤ 14.0.0.20247
Affected products
| Product | Versions |
|---|---|
| IGSS Definition (Def.exe) version 14.0.0.20247 and prior | affected IGSS Definition (Def.exe) version 14.0.0.20247 and prior |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |