var-202106-0530
Vulnerability from variot
A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing size checks, when a malicious WSP (Workspace) file is being parsed by IGSS Definition. Schneider Electric The following vulnerabilities exist in multiple products provided by the company. IGSS ‥ * Out-of-bounds writing (CWE-787) - CVE-2021-22750 , CVE-2021-22751 , CVE-2021-22752 , CVE-2021-22754 , CVE-2021-22755 ‥ * Out-of-bounds reading (CWE-125) - CVE-2021-22753 , CVE-2021-22756 , CVE-2021-22757 ‥ * Accessing uninitialized pointers (CWE-824) - CVE-2021-22758 ‥ * Use of freed memory (Use-after-free) (CWE-416) - CVE-2021-22759 ‥ * Freeing invalid pointers and references (CWE-763) - CVE-2021-22760 ‥ * Buffer error (CWE-119) - CVE-2021-22761 ‥ * Directory traversal (CWE-22) - CVE-2021-22762Modicon X80 ‥ * Information leakage vulnerability (CWE-200) - CVE-2021-22749The expected impact depends on the vulnerability, but it can be impacted as follows: IGSS ‥ * Fraudulent, crafted by a third party CGF (Configuration Group File) Data is lost or code is executed when importing a file - CVE-2021-22750 , CVE-2021-22754 , CVE-2021-22758 , CVE-2021-22759 , CVE-2021-22760 ‥ * Fraudulent, crafted by a third party CGF (Configuration Group File) Information is stolen or arbitrary code is executed when a file is imported - CVE-2021-22751 ‥ * Fraudulent, crafted by a third party CGF (Configuration Group File) Information is stolen or code is executed when a file is imported - CVE-2021-22755 , CVE-2021-22756 , CVE-2021-22757 , CVE-2021-22761 ‥ * Fraudulent, crafted by a third party WSP (Workspace) Data is lost or code is executed when parsing a file - CVE-2021-22752 , CVE-2021-22753 ‥ * Fraudulent, crafted by a third party CGF (Configuration Group File) , Or WSP (Workspace) Code is executed when the file is imported - CVE-2021-22762Modicon X80 ‥ * Crafted by a remote third party, HTTP Includes communication parameters used for telemetry when a request is received RTU Information is stolen regarding settings - CVE-2021-22749. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric IGSS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of WSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. The Schneider Electric Interactive Graphical SCADA System (IGSS) is an advanced SCADA system for monitoring and controlling industrial processes
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "interactive graphical scada system",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "15.0.0.21140"
},
{
"_id": null,
"model": "modicon x80 bmxnor0200h rtu",
"scope": "lte",
"trust": 0.8,
"vendor": "schneider electric",
"version": "sv1.70 ir22 and earlier"
},
{
"_id": null,
"model": "igss definition",
"scope": null,
"trust": 0.8,
"vendor": "schneider electric",
"version": null
},
{
"_id": null,
"model": "igss",
"scope": null,
"trust": 0.7,
"vendor": "schneider electric",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-673"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001884"
},
{
"db": "NVD",
"id": "CVE-2021-22752"
}
]
},
"credits": {
"_id": null,
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-673"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-629"
}
],
"trust": 1.3
},
"cve": "CVE-2021-22752",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2021-22752",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-381226",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2021-22752",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "IPA",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2021-001884",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2021-22752",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2021-22752",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "IPA",
"id": "JVNDB-2021-001884",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2021-22752",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202106-629",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-381226",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-673"
},
{
"db": "VULHUB",
"id": "VHN-381226"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001884"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-629"
},
{
"db": "NVD",
"id": "CVE-2021-22752"
}
]
},
"description": {
"_id": null,
"data": "A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing size checks, when a malicious WSP (Workspace) file is being parsed by IGSS Definition. Schneider Electric The following vulnerabilities exist in multiple products provided by the company. IGSS \u2025 * Out-of-bounds writing (CWE-787) - CVE-2021-22750 , CVE-2021-22751 , CVE-2021-22752 , CVE-2021-22754 , CVE-2021-22755 \u2025 * Out-of-bounds reading (CWE-125) - CVE-2021-22753 , CVE-2021-22756 , CVE-2021-22757 \u2025 * Accessing uninitialized pointers (CWE-824) - CVE-2021-22758 \u2025 * Use of freed memory (Use-after-free) (CWE-416) - CVE-2021-22759 \u2025 * Freeing invalid pointers and references (CWE-763) - CVE-2021-22760 \u2025 * Buffer error (CWE-119) - CVE-2021-22761 \u2025 * Directory traversal (CWE-22) - CVE-2021-22762Modicon X80 \u2025 * Information leakage vulnerability (CWE-200) - CVE-2021-22749The expected impact depends on the vulnerability, but it can be impacted as follows: IGSS \u2025 * Fraudulent, crafted by a third party CGF (Configuration Group File) Data is lost or code is executed when importing a file - CVE-2021-22750 , CVE-2021-22754 , CVE-2021-22758 , CVE-2021-22759 , CVE-2021-22760 \u2025 * Fraudulent, crafted by a third party CGF (Configuration Group File) Information is stolen or arbitrary code is executed when a file is imported - CVE-2021-22751 \u2025 * Fraudulent, crafted by a third party CGF (Configuration Group File) Information is stolen or code is executed when a file is imported - CVE-2021-22755 , CVE-2021-22756 , CVE-2021-22757 , CVE-2021-22761 \u2025 * Fraudulent, crafted by a third party WSP (Workspace) Data is lost or code is executed when parsing a file - CVE-2021-22752 , CVE-2021-22753 \u2025 * Fraudulent, crafted by a third party CGF (Configuration Group File) , Or WSP (Workspace) Code is executed when the file is imported - CVE-2021-22762Modicon X80 \u2025 * Crafted by a remote third party, HTTP Includes communication parameters used for telemetry when a request is received RTU Information is stolen regarding settings - CVE-2021-22749. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric IGSS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of WSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. The Schneider Electric Interactive Graphical SCADA System (IGSS) is an advanced SCADA system for monitoring and controlling industrial processes",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-22752"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001884"
},
{
"db": "ZDI",
"id": "ZDI-21-673"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "VULHUB",
"id": "VHN-381226"
}
],
"trust": 2.88
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2021-22752",
"trust": 3.2
},
{
"db": "SCHNEIDER",
"id": "SEVD-2021-159-01",
"trust": 1.7
},
{
"db": "ICS CERT",
"id": "ICSA-21-159-04",
"trust": 1.4
},
{
"db": "ZDI",
"id": "ZDI-21-673",
"trust": 1.3
},
{
"db": "ICS CERT",
"id": "ICSA-21-159-05",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU94079949",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001884",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-12773",
"trust": 0.7
},
{
"db": "CS-HELP",
"id": "SB2021041363",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021060921",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2048",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202106-629",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2021-42157",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-381226",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-673"
},
{
"db": "VULHUB",
"id": "VHN-381226"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001884"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-629"
},
{
"db": "NVD",
"id": "CVE-2021-22752"
}
]
},
"id": "VAR-202106-0530",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-381226"
}
],
"trust": 0.01
},
"last_update_date": "2024-08-14T12:39:49.130000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Embedded\u00a0Web\u00a0Server\u00a0for\u00a0Modicon\u00a0X80\u00a0BMXNOR0200H\u00a0RTU\u00a0Module",
"trust": 0.8,
"url": "https://igss.schneider-electric.com/igss/igssupdates/v150/IGSSUPDATE.ZIP"
},
{
"title": "Schneider Electric has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-04"
},
{
"title": "Schneider Electric IGSS Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=153287"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-673"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001884"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-629"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-787",
"trust": 1.1
},
{
"problemtype": "Buffer error (CWE-119) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Out-of-bounds read (CWE-125) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " information leak (CWE-200) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Path traversal (CWE-22) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use of freed memory (CWE-416) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Freeing invalid pointers and references (CWE-763) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Out-of-bounds writing (CWE-787) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Accessing uninitialized pointers (CWE-824) [IPA Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-381226"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001884"
},
{
"db": "NVD",
"id": "CVE-2021-22752"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 2.1,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-04"
},
{
"trust": 1.7,
"url": "http://download.schneider-electric.com/files?p_doc_ref=sevd-2021-159-01"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu94079949"
},
{
"trust": 0.8,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-05"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
},
{
"trust": 0.6,
"url": "https://www.zerodayinitiative.com/advisories/zdi-21-673/"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-22752"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2048"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021060921"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-673"
},
{
"db": "VULHUB",
"id": "VHN-381226"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001884"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-629"
},
{
"db": "NVD",
"id": "CVE-2021-22752"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "ZDI",
"id": "ZDI-21-673",
"ident": null
},
{
"db": "VULHUB",
"id": "VHN-381226",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001884",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-202106-629",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2021-22752",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2021-06-10T00:00:00",
"db": "ZDI",
"id": "ZDI-21-673",
"ident": null
},
{
"date": "2021-06-11T00:00:00",
"db": "VULHUB",
"id": "VHN-381226",
"ident": null
},
{
"date": "2021-06-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-001884",
"ident": null
},
{
"date": "2021-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975",
"ident": null
},
{
"date": "2021-06-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-629",
"ident": null
},
{
"date": "2021-06-11T16:15:09.403000",
"db": "NVD",
"id": "CVE-2021-22752",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2021-06-10T00:00:00",
"db": "ZDI",
"id": "ZDI-21-673",
"ident": null
},
{
"date": "2021-06-15T00:00:00",
"db": "VULHUB",
"id": "VHN-381226",
"ident": null
},
{
"date": "2021-06-11T07:10:00",
"db": "JVNDB",
"id": "JVNDB-2021-001884",
"ident": null
},
{
"date": "2021-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975",
"ident": null
},
{
"date": "2021-06-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-629",
"ident": null
},
{
"date": "2021-06-15T18:42:37.090000",
"db": "NVD",
"id": "CVE-2021-22752",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-629"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "plural \u00a0Schneider\u00a0Electric\u00a0 Product vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001884"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…