PT-2021-2368 · Igss · Igss

Published 2021-03-09 · Updated 2021-03-17 · CVE-2021-22709

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Interactive Graphical SCADA System (IGSS) versions 15.0.0.21041 and prior

Description A memory buffer vulnerability exists in the Interactive Graphical SCADA System (IGSS) Definition, which could result in loss of data or remote code execution when a malicious Configuration Group File (CGF) is imported. This issue is caused by improper restriction of operations within the bounds of a memory buffer. The exploitation of this vulnerability may allow a remote attacker to execute arbitrary code.

Recommendations For versions 15.0.0.21041 and prior, consider disabling the import of CGF files until a patch is available to prevent potential remote code execution. Restrict access to the IGSS Definition to minimize the risk of exploitation. Avoid using malicious or unverified CGF files in the affected system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2021-01608

CVE-2021-22709

ZDI-21-272

Affected Products

Igss

References · 7

• https://se.com/ww/en/download/document/SEVD-2021-068-01 · Vendor Advisory
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-068-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22709 · Security Note
• https://bdu.fstec.ru/vul/2021-01608 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-272 · Security Note
• https://t.me/cibsecurity/24829 · Telegram Post