PT-2022-3589 · Unknown · Igss Data Server

Published 2022-04-12 · Updated 2023-02-08 · CVE-2022-2329

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IGSS Data Server - IGSSdataServer.exe versions prior to V15.0.0.22073

Description A CWE-190: Integer Overflow or Wraparound issue exists, potentially causing a heap-based buffer overflow. This could lead to denial of service and possibly remote code execution if an attacker sends multiple specially crafted messages. The vulnerability can be exploited by a remote attacker by sending a specially crafted message, allowing them to execute arbitrary code.

Recommendations For versions prior to V15.0.0.22073, update to version V15.0.0.22073 or later to resolve the issue. As a temporary workaround, consider restricting access to the IGSSdataServer.exe module to minimize the risk of exploitation. Avoid using the affected module until the issue is resolved.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2022-04373

CVE-2022-2329

Affected Products

Igss Data Server

References · 6

• https://bdu.fstec.ru/vul/2022-04373 · Security Note
• https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-102-01_IGSS_Security_Notification_V2.0.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2329 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2329 · Vendor Advisory
• https://t.me/cvenotify/43294 · Telegram Post
• https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-102-01_IGSS_Security_Notification_V2.0.pdf · Note