CVE-2020-7557: Schneider Electric IGSS CGF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
First published: Thu Nov 19 2020(Updated: )
A CWE-125 Out-of-bounds Read vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
Credit: cybersecurity@se.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Schneider-electric Interactive Graphical Scada System | <=14.0.0.20247 | |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-7557?
CVE-2020-7557 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of Schneider Electric IGSS.
How can an attacker exploit CVE-2020-7557?
To exploit CVE-2020-7557, an attacker requires user interaction in the form of visiting a malicious page or opening a malicious file.
What is the affected software for CVE-2020-7557?
The affected software for CVE-2020-7557 is Schneider Electric IGSS up to version 14.0.0.20247.
What is the severity of CVE-2020-7557?
The severity of CVE-2020-7557 is rated as high with a CVSS score of 7.8.
How do I fix CVE-2020-7557?
To fix CVE-2020-7557, users are advised to upgrade to a patched version provided by Schneider Electric.
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/tags
- agent/softwarecombine
- agent/event
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-21-096
- alias/ZDI-CAN-11297
- alias/CVE-2020-7557
- agent/software-canonical-lookup
- vendor/schneider-electric
- canonical/schneider-electric interactive graphical scada system
- version/schneider-electric interactive graphical scada system/14.0.0.20247
- vendor/schneider electric
- canonical/schneider electric igss