CVE-2023-27978

CWE-502 — Deserialization of Untrusted Data3 documents3 sources
Severity
7.8HIGH
EPSS
3.9%
top 11.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Schneider Electric Custom Reports (rms16.dll)Schneider Electric Igss Dashboard (dashboard.exe)Schneider Electric Igss Data Server(igssdataserver.exe)+3 more
Timeline
PublishedMar 21

Description

A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5schneider_electric/custom_reports_(rms16.dll)V — 16.0.0.23040

Patches

Patch: download.schneider-electric.com ↗Patch: download.schneider-electric.com ↗

🔴Vulnerability Details

2
CVEList
CVE-2023-27978: A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data↗2023-03-21
▶
GHSA
GHSA-j943-j589-56x5: A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data↗2023-03-21
▶
CVE-2023-27978 (HIGH CVSS 7.8) | A CWE-502: Deserialization of Untru | cvebase.io