PT-2021-15193 · Unknown · Igss Definition

Published 2021-06-11 · Updated 2021-06-15 · CVE-2021-22755

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IGSS Definition (Def.exe) versions prior to 15.0.0.21140

Description A vulnerability exists due to a lack of sanity checks on user-supplied data. When a malicious CGF file is imported to IGSS Definition, it could result in disclosure of information or remote code execution.

Recommendations For versions prior to 15.0.0.21140, avoid importing CGF files from untrusted sources until a patch is available. As a temporary workaround, consider restricting the import functionality of IGSS Definition to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-22755

Affected Products

Igss Definition

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-22755 · Security Note
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22755 · Vendor Advisory