Vulnerability Description
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS project report directory, when an attacker sends specific crafted messages to the Data Server TCP port, this could lead to remote code execution when a victim eventually opens a malicious dashboard file. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Schneider-Electric | Custom Reports | <= 16.0.0.23040 |
| Schneider-Electric | Igss Dashboard | <= 16.0.0.23040 |
| Schneider-Electric | Igss Data Server | <= 16.0.0.23040 |
Related Weaknesses (CWE)
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocPatchVendor Advisory
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocPatchVendor Advisory
FAQ
What is CVE-2023-27982?
CVE-2023-27982 is a vulnerability with a CVSS score of 8.8 (HIGH). A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS project report directory, when an attacke...
How severe is CVE-2023-27982?
CVE-2023-27982 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-27982?
Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Custom Reports, Schneider-Electric Igss Dashboard, Schneider-Electric Igss Data Server.