CVE-2022-24317: Schneider Electric IGSS Missing Authentication Information Disclosure Vulnerability
First published: Wed Feb 09 2022(Updated: )
A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
Credit: cybersecurity@se.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Schneider Electric IGSS | ||
| Schneider-electric Interactive Graphical Scada System Data Server | <=15.0.0.22020 | |
| Schneider Electric IGSS Data Server (IGSSdataServer.exe): v15.0.0.22020 and prior |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-24317.
What is the title of the vulnerability?
The title of the vulnerability is Schneider Electric IGSS Missing Authentication Information Disclosure Vulnerability.
How severe is CVE-2022-24317?
CVE-2022-24317 has a severity rating of 7.5 (high).
How can the vulnerability be exploited?
Remote attackers can exploit this vulnerability to disclose sensitive information on affected installations of Schneider Electric IGSS.
What software is affected by CVE-2022-24317?
Schneider Electric IGSS versions up to and including 15.0.0.22020 are affected by CVE-2022-24317.
Is authentication required to exploit the vulnerability?
No, authentication is not required to exploit CVE-2022-24317.
Where can I find more information about CVE-2022-24317?
You can find more information about CVE-2022-24317 at the following references: [Reference 1](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01), [Reference 2](https://www.cisa.gov/uscert/ics/advisories/icsa-22-046-01), [Reference 3](https://www.zerodayinitiative.com/advisories/ZDI-22-324/).
What Common Weakness Enumeration (CWE) category does CVE-2022-24317 belong to?
CVE-2022-24317 belongs to the CWE category 862.
How can I fix CVE-2022-24317?
To fix CVE-2022-24317, it is recommended to apply the necessary security patches or updates provided by Schneider Electric.
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-22-324
- alias/ZDI-CAN-15193
- alias/CVE-2022-24317
- agent/software-canonical-lookup
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/event
- agent/references
- agent/softwarecombine
- agent/tags
- collector/ics-cert-advisory
- source/ICS
- vendor/schneider electric
- canonical/schneider electric igss
- vendor/schneider-electric
- canonical/schneider-electric interactive graphical scada system data server
- version/schneider-electric interactive graphical scada system data server/15.0.0.22020
- canonical/schneider electric igss data server (igssdataserver.exe): v15.0.0.22020 and prior