CVE-2023-27981: Schneider Electric Custom Reports

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code execution when a victim tries to open a malicious report. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).

Affected products

• Schneider Electric Custom Reports: up to and including 16.0.0.23040
• Schneider Electric Igss Dashboard: up to and including 16.0.0.23040
• Schneider Electric Igss Data Server: up to and including 16.0.0.23040

Published 2023-03-21. Last modified 2026-06-17.