Schneider Electric Interactive Graphical Scada System Data Collector vulnerabilities

6 CVEs affecting Schneider Electric Interactive Graphical Scada System Data Collector, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22824, published 2022-02-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22823, published 2022-02-11. Critical severity, CVSS 9.1. EPSS: 21.4% chance of exploitation in the next 30 days. A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IGSS due to lack of validation of network…
CVE-2021-22802, published 2022-02-11. Critical severity, CVSS 9.8. EPSS: 20.2% chance of exploitation in the next 30 days. A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length check on user supplied data, when a constructed message is…
CVE-2021-22824, published 2022-02-11. High severity, CVSS 7.5. EPSS: 14.2% chance of exploitation in the next 30 days. A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in denial of service, due to missing length check on user-supplied data from a constructed message…
CVE-2021-22803, published 2022-02-11. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths, when an attacker, writes arbitrary files to folders…
CVE-2021-22804, published 2022-02-11. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files being read in the context of the user running IGSS, due to…
CVE-2021-22805, published 2022-02-11. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IGSS due to lack of validation of network…