Schneider ELectric IGSS Data Server(IGSSdataServer.exe)

• CVE-2023-27981 High 7.8 A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code execution when a victim tries to open a malicious report. Af 0.7%
• CVE-2023-27978 High 7.8 A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution whe 6.5%
• CVE-2023-27979 Medium 6.5 A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project report directory, this could lead to denial 0.2%
• CVE-2023-27980 High 8.8 A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious report file in the IGSS project report direct 0.9%
• CVE-2023-27982 High 8.8 A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS project report directory, when an attacke 0.4%
• CVE-2023-27983 Medium 6.5 A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGSS project report directory, this would le 0.4%
• CVE-2023-27984 High 7.8 A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to remote code execution when a user opens a malicious report fi 0.6%
• CVE-2023-27977 Medium 6.5 A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in the IGSS project report directory, this could lead to loss 0.2%