CVE-2020-7478
published 2020-03-23CVE-2020-7478: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a…
PriorityP352high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
3.97%
89.2th percentile
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update Service is enabled.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| schneider-electric | interactive_graphical_scada_system | >= 14.0 < 14.0.0.20009 | 14.0.0.20009 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Schneider Electric IGSS SCADA Software
cisa_ics·2020-04-03·CVSS 7.5
[HIGH] Schneider Electric IGSS SCADA Software
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Schneider Electric IGSS SCADA Software
Last RevisedApril 03, 2020
Alert CodeICSA-20-084-02
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: Schneider Electric
- Equipment: IGSS (Interactive Graphical SCADA System)
- Vulnerabilities: Path Traversal, Missing Authentication for Critical Function
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in unauthorized access to sensitive data and functions.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of IGSS ar
GHSA
GHSA-hm9h-wf2r-4pc5: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which coul
ghsa_unreviewed·2022-05-24
CVE-2020-7478 [MEDIUM] CWE-22 GHSA-hm9h-wf2r-4pc5: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which coul
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update Service is enabled.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-03-23
Published