Vulnerability · Published Jun 14, 2023 · Assigned by schneider
CVE-2023-3001
High 7.8
In plain English
A high-severity unsafe deserialization in IGSS Dashboard (DashBoard.exe) from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 31.9% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)31.9%top 1.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | IGSS Dashboard (DashBoard.exe) | v16.0.0.23130 and prior |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H