High severity · published Jun 11, 2021
CVE-2021-22760
A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code…
7.8
CVSS
1.2%
EPSS
No
On KEV
Description
A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing checks of user-supplied input data, when a malicious CGF file is imported to IGSS Definition.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IG
Interactive Graphical Scada System · Schneider-electric
through 15.0.0.21140 · source: NVD
Affected product
IG
Interactive Graphical Scada System
Schneider-electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22760
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22760
Vendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01
More from Interactive Graphical Scada System
9.8
CVE-2022-2329
A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote code execution when…
9.8
CVE-2022-24324
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an…
9.8
CVE-2022-32529
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an…
9.8
CVE-2022-32527
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an…
9.8
CVE-2022-32526
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an…