CVSS: 9.8EPSS: 0%CPEs: 66EXPL: 0CVE-2022-22813
https://notcve.org/view.php?id=CVE-2022-22813
A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active control of the Courier tunneling communication network, they could potentially observe and manipulate traffic associated with product configuration. Una CWE-798: Se presenta una vulnerabilidad de Uso de Credenciales Embebidas. Si un atacante obtuviera la clave criptográfica TLS y tomara el control activo de la red de comunicación de túneles de Courier, podría potencialmente observar y manipular el tráfico asociado a la configuración del producto • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-03 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24317 – Schneider Electric IGSS Missing Authentication Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-24317
A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Una CWE-862: Se presenta una vulnerabilidad de Falta de Autorización que podría causar una exposición de información cuando un atacante envía un mensaje específico. Producto afectado: Interactive Graphical SCADA System Data Server (versiones V15.0.0.22020 y anteriores) This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric IGSS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IGSSDataServer process, which listens on TCP port 12401 by default. The issue results from the lack of authentication prior to allowing access to functionality. • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 https://www.zerodayinitiative.com/advisories/ZDI-22-324 • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24316 – Schneider Electric IGSS IGSSdataServer Uninitialized Memory Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-24316
A CWE-665: Improper Initialization vulnerability exists that could cause information exposure when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Una CWE-665: Se presenta una vulnerabilidad de Inicialización Inapropiada que podría causar una exposición de información cuando un atacante envía un mensaje especialmente diseñado. Producto afectado: Interactive Graphical SCADA System Data Server (versiones V15.0.0.22020 y anteriores) This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric IGSS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IGSSDataServer process, which listens on TCP port 12401 by default. The issue results from the lack of proper initialization of memory prior to accessing it. • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 https://www.zerodayinitiative.com/advisories/ZDI-22-323 • CWE-665: Improper Initialization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24315 – Schneider Electric IGSS Out-Of-Bounds Read Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-24315
A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Una CWE-125: Se presenta una vulnerabilidad de Lectura Fuera de Límites que podría causar una denegación de servicio cuando un atacante envía repetidamente un mensaje especialmente diseñado. Producto afectado: Interactive Graphical SCADA System Data Server (versiones V15.0.0.22020 y anteriores) This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Schneider Electric IGSS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IGSSDataServer process, which listens on TCP port 12401 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 https://www.zerodayinitiative.com/advisories/ZDI-22-322 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24314
https://notcve.org/view.php?id=CVE-2022-24314
A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Una CWE-125: Se presenta una vulnerabilidad de Lectura Fuera de Límites que podría causar pérdidas de memoria que podrían resultar en una denegación de servicio cuando un atacante envía repetidamente un mensaje especialmente diseñado. Producto afectado: Interactive Graphical SCADA System Data Server (versiones V15.0.0.22020 y anteriores) • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 • CWE-125: Out-of-bounds Read •