PT-2021-2330 · Igss · Igss

Published 2021-03-09 · Updated 2021-03-17 · CVE-2021-22712

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Interactive Graphical SCADA System (IGSS) versions 15.0.0.21041 and prior

Description A memory buffer vulnerability exists due to improper restriction of operations within the bounds of a memory buffer, which could result in arbitrary read or write conditions when a malicious CGF (Configuration Group File) file is imported to IGSS Definition due to an unchecked pointer address. This issue may allow a remote attacker to execute remote code execution by using a specially crafted CGF file.

Recommendations For versions 15.0.0.21041 and prior, consider disabling the import of CGF files until a patch is available to prevent exploitation of the memory corruption vulnerability. Restrict access to the IGSS Definition to minimize the risk of exploitation. Avoid using specially crafted CGF files in the affected IGSS version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2021-01565

CVE-2021-22712

ZDI-21-269

Affected Products

Igss

References · 7

• https://se.com/ww/en/download/document/SEVD-2021-068-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22712 · Vendor Advisory
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-068-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01565 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-269 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22712 · Security Note
• https://t.me/cibsecurity/24820 · Telegram Post