CVE-2023-27978: High severity schneider-electric custom reports vulnerability
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-27978?
The severity of CVE-2023-27978 is high, with a severity value of 7.8.
What is the vulnerability description of CVE-2023-27978?
CVE-2023-27978 is a CWE-502: Deserialization of Untrusted Data vulnerability in the Dashboard module that could lead to remote code execution if a user opens a malicious file.
Which products are affected by CVE-2023-27978?
The affected products by CVE-2023-27978 are Schneider-electric Custom Reports, Schneider-electric Igss Dashboard, and Schneider-electric Igss Data Server, all with version up to and including 16.0.0.23040.
How can the CVE-2023-27978 vulnerability be exploited?
The CVE-2023-27978 vulnerability can be exploited by an attacker who convinces the user to open a malicious file, leading to the execution of remote code.
Is there a security notice or reference available for CVE-2023-27978?
Yes, you can find the security notice and detailed information about CVE-2023-27978 at the following reference: [here](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf).