IM
IronMonkey Threat Research
‹ Back to ICS Advisories

IGSS (Interactive Graphical SCADA System)

HIGH
CVSS 7.8
Date 2026-10-16T20:41:01+00:00
Source schneider-electric
Published by Schneider Electric

// Description

Schneider Electric Security Notification 9-Mar-21 Document Reference Number – SEVD-2021 -068-01 Page 1 of 4 ## IGSS (Interactive Graphical SCADA System) 9 March 2021 # Overview Schneider Electric is aware of multiple vulnerabilities in the Interactive Graphical SCADA System (IGSS) product. The IGSS product is a state-of-the art SCADA system used for monitoring and controlling industrial processes. IGSS communicates with all major industry standard PLC drivers. Failure to apply the remediations provided below may risk remote code execution, which could result in an attacker gaining access to the Windows Operating System on the machine used to import CGF files, typically a step performed during system design time. # Affected Product and Versions IGSS Definition (Def.exe) version 15.0.0.21041 and prior # Vulnerability Details CVE ID: CVE-2021-22709 CVSS v3.0 Base Score 7.8 | High | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could result in loss of data or remote code execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. CVE ID: CVE-2021-22710 CVSS v3.0 Base Score 7.8 | High | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause remote code execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. CVE ID: CVE-2021-22711 CVSS v3.0 Base Score 7.8 | High | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could result in arbitrary read or write conditions when malicious CGF (Configuration Group File) file is imported to IGSS Definition due to missing validation of input data. Schneider Electric Security Notification

// Vulnerabilities (4)

CVE ID CVSS Score Severity Description
CVE-2021-22712 7.8 high
This vulnerability could result in arbitrary read or write conditions due to an unchecked pointer address when a malicious CGF file is imported into an IGSS Definition.CVE-2021-22712 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22709 7.8 high
This vulnerability could result in loss of data or remote code execution when a malicious CGF (configuration group file) file is imported into an IGSS Definition.CVE-2021-22709 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22711 7.8 high
This vulnerability could result in arbitrary read or write conditions due to missing validation of input data when a malicious CGF file is imported into an IGSS Definition.CVE-2021-22711 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22710 7.8 high
This vulnerability could result in loss of data or remote code execution when a malicious CGF file is imported into an IGSS Definition.CVE-2021-22710 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

// Remediations (3)

Mitigation: Avoid importing CGF files from untrusted sources.
Avoid importing CGF files from untrusted sources.
Mitigation: For more information, see the Schneider Electric security notification.
For more information, see the Schneider Electric security notification.
Mitigation: Schneider Electric has provided Version 15.0.0.21042 of the IGSS Definition module: Def.exe to addre
Schneider Electric has provided Version 15.0.0.21042 of the IGSS Definition module: Def.exe to address these vulnerabilities. The update is available for download through IGSS Master > Update IGSS Software or from the Schneider Electric support page.

// References