CVE-2023-27983mediumCWE-306

CVE-2023-27983: medium-severity vulnerability in Schneider Electric IGSS Data…

Published · Updated

Follow this CVE+ Monitor IGSS Data Server+ Monitor IGSS Dashboard

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.4%
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGSS project report directory, this would lead to loss of data when an attacker abuses this functionality. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
Schneider Electric · Custom Reports (RMS16.dll)Schneider Electric · IGSS Dashboard (DashBoard.exe)Schneider Electric · IGSS Data Server(IGSSdataServer.exe)
Related CVEs — Schneider Electric IGSS Data…

In the same product, most dangerous first.

CVE-2023-3001HIGHCVE-2023-3001EPSS 31.9%CVE-2023-27978HIGHCVE-2023-27978EPSS 6.5%CVE-2023-27980HIGHCVE-2023-27980EPSS 0.9%CVE-2023-27981HIGHCVE-2023-27981EPSS 0.7%CVE-2023-27984HIGHCVE-2023-27984EPSS 0.6%CVE-2023-27982HIGHCVE-2023-27982EPSS 0.4%