PT-2021-15199 · Schneider Electric · Igss

Published 2021-06-10 · Updated 2021-06-15 · CVE-2021-22761

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Schneider Electric IGSS versions prior to V15.0.0.21140

Description A memory buffer vulnerability exists due to missing length checks on user-supplied data. This issue can be triggered when a malicious CGF file is imported, potentially leading to disclosure of information or remote code execution.

Recommendations For versions prior to V15.0.0.21140, consider restricting the import of CGF files from untrusted sources until a patch is available. As a temporary workaround, avoid using the IGSS Definition (Def.exe) to import CGF files that may be malicious. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2021-22761

ZDI-21-676

Affected Products

Igss

References · 4

• https://zerodayinitiative.com/advisories/ZDI-21-676 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22761 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22761 · Vendor Advisory
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01 · Vendor Advisory