Vulnerability · Published Mar 23, 2020 · Assigned by schneider
CVE-2020-7478
High 7.5
In plain English
A high-severity path traversal in IGSS (Interactive Graphical SCADA System) (IGSS Version prior to 14.0.0.20009). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)4.1%top 9.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update Service is enabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | IGSS (Interactive Graphical SCADA System) (IGSS Version prior to 14.0.0.20009) | IGSS (Interactive Graphical SCADA System) (Versions 14 and prior using the service: IGSSupdate) |
Weakness: CWE-22
References
- https://www.se.com/ww/en/download/document/SEVD-2020-070-01/ x_refsource_MISC
- https://www.zerodayinitiative.com/advisories/ZDI-20-371/ x_refsource_MISC