PT-2023-4985 · Unknown · Igss Update Service

Published 2023-09-12 · Updated 2023-09-20 · CVE-2023-4516

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IGSS Update Service (affected versions not specified)

Description A Missing Authentication for Critical Function issue exists in the IGSS Update Service, potentially allowing a local attacker to change the update source. This could lead to remote code execution if the attacker forces an update containing malicious content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-05524

CVE-2023-4516

Affected Products

Igss Update Service

References · 7

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-255-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-255-01.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05524 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4516 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4516 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-255-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-255-01.pdf · Note
• https://t.me/cibsecurity/70432 · Telegram Post
• https://twitter.com/cracbot/status/1702562940568895659 · Twitter Post