Schneider Electric Custom Reports vulnerabilities

8 CVEs affecting Schneider Electric Custom Reports, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-27983, published 2023-03-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-27978, published 2023-03-21. High severity, CVSS 7.8. EPSS: 6.5% chance of exploitation in the next 30 days. A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution…
CVE-2023-27980, published 2023-03-21. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious report file in the IGSS project report…
CVE-2023-27981, published 2023-03-21. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code execution when a victim tries to open a malicious report.…
CVE-2023-27984, published 2023-03-21. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to remote code execution when a user opens a malicious report…
CVE-2023-27983, published 2023-03-21. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGSS project report directory, this would…
CVE-2023-27982, published 2023-03-21. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS project report directory, when an…
CVE-2023-27977, published 2023-03-21. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in the IGSS project report directory, this could lead to loss…
CVE-2023-27979, published 2023-03-21. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project report directory, this could lead to…