CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24317 – Schneider Electric IGSS Missing Authentication Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-24317
A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Una CWE-862: Se presenta una vulnerabilidad de Falta de Autorización que podría causar una exposición de información cuando un atacante envía un mensaje específico. Producto afectado: Interactive Graphical SCADA System Data Server (versiones V15.0.0.22020 y anteriores) This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric IGSS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IGSSDataServer process, which listens on TCP port 12401 by default. The issue results from the lack of authentication prior to allowing access to functionality. • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 https://www.zerodayinitiative.com/advisories/ZDI-22-324 • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24316 – Schneider Electric IGSS IGSSdataServer Uninitialized Memory Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-24316
A CWE-665: Improper Initialization vulnerability exists that could cause information exposure when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Una CWE-665: Se presenta una vulnerabilidad de Inicialización Inapropiada que podría causar una exposición de información cuando un atacante envía un mensaje especialmente diseñado. Producto afectado: Interactive Graphical SCADA System Data Server (versiones V15.0.0.22020 y anteriores) This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric IGSS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IGSSDataServer process, which listens on TCP port 12401 by default. The issue results from the lack of proper initialization of memory prior to accessing it. • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 https://www.zerodayinitiative.com/advisories/ZDI-22-323 • CWE-665: Improper Initialization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24315 – Schneider Electric IGSS Out-Of-Bounds Read Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-24315
A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Una CWE-125: Se presenta una vulnerabilidad de Lectura Fuera de Límites que podría causar una denegación de servicio cuando un atacante envía repetidamente un mensaje especialmente diseñado. Producto afectado: Interactive Graphical SCADA System Data Server (versiones V15.0.0.22020 y anteriores) This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Schneider Electric IGSS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IGSSDataServer process, which listens on TCP port 12401 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 https://www.zerodayinitiative.com/advisories/ZDI-22-322 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24314
https://notcve.org/view.php?id=CVE-2022-24314
A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Una CWE-125: Se presenta una vulnerabilidad de Lectura Fuera de Límites que podría causar pérdidas de memoria que podrían resultar en una denegación de servicio cuando un atacante envía repetidamente un mensaje especialmente diseñado. Producto afectado: Interactive Graphical SCADA System Data Server (versiones V15.0.0.22020 y anteriores) • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2022-24313 – Schneider Electric IGSS IGSSDataServer Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-24313
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Una CWE-120: Se presenta una vulnerabilidad de Copia del Búfer sin Comprobar el Tamaño de la Entrada que podría causar un desbordamiento del búfer en la región stack de la memoria que podría conllevar a una ejecución de código remoto cuando un atacante envía un mensaje especialmente diseñado. Producto afectado: Interactive Graphical SCADA System Data Server (versiones V15.0.0.22020 y anteriores) This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric IGSS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IGSSDataServer process, which listens on TCP port 12401 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 https://www.zerodayinitiative.com/advisories/ZDI-22-325 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •