CVE-2022-24317: Schneider Electric IGSS Missing Authentication Information Disclosure Vulnerability
A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric IGSS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IGSSDataServer process, which listens on TCP port 12401 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose information from the IGSS application.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-24317.
What is the title of the vulnerability?
The title of the vulnerability is Schneider Electric IGSS Missing Authentication Information Disclosure Vulnerability.
How severe is CVE-2022-24317?
CVE-2022-24317 has a severity rating of 7.5 (high).
How can the vulnerability be exploited?
Remote attackers can exploit this vulnerability to disclose sensitive information on affected installations of Schneider Electric IGSS.
What software is affected by CVE-2022-24317?
Schneider Electric IGSS versions up to and including 15.0.0.22020 are affected by CVE-2022-24317.
Is authentication required to exploit the vulnerability?
No, authentication is not required to exploit CVE-2022-24317.
Where can I find more information about CVE-2022-24317?
You can find more information about CVE-2022-24317 at the following references: [Reference 1](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01), [Reference 2](https://www.cisa.gov/uscert/ics/advisories/icsa-22-046-01), [Reference 3](https://www.zerodayinitiative.com/advisories/ZDI-22-324/).
What Common Weakness Enumeration (CWE) category does CVE-2022-24317 belong to?
CVE-2022-24317 belongs to the CWE category 862.
How can I fix CVE-2022-24317?
To fix CVE-2022-24317, it is recommended to apply the necessary security patches or updates provided by Schneider Electric.