PT-2021-15192 · Unknown · Igss Definition

Published 2021-06-11 · Updated 2021-06-15 · CVE-2021-22754

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IGSS Definition (Def.exe) versions prior to 15.0.0.21140

Description A vulnerability exists due to the lack of proper validation of user-supplied data. When a malicious CGF file is imported to IGSS Definition, it could result in loss of data or remote code execution.

Recommendations For versions prior to 15.0.0.21140, avoid importing CGF files from untrusted sources until a fix is available. As a temporary workaround, consider restricting the import functionality of IGSS Definition to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-22754

Affected Products

Igss Definition

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-22754 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22754 · Vendor Advisory
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01 · Vendor Advisory