IM
IronMonkey Threat Research
‹ Back to ICS Advisories

IGSS (Interactive Graphical SCADA System)

HIGH
CVSS 7.8
Date 2026-10-16T20:42:57+00:00
Source schneider-electric
Published by Schneider Electric

// Description

Schneider Electric Security Notification 10-Mar-20 Document Reference Number – SEVD-2020 -070-01 Page 1 of 4 ## IGSS (Interactive Graphical SCADA System) 10 March 2020 ## Overview Schneider Electric is aware of multiple vulnerabilities in the IGSS product. ## Affected Product(s) IGSS versions 14 and prior using the service: IGSSupdate. ## Vulnerability Details CVE ID: CVE-2020-7479 CVSS v3.0 Base Score 7.8 | (High) | CVSS.3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H A CWE-306: Missing Authentication for Critical Function vulnerability exists which could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the IGSS Update Service. CVE ID: CVE-2020-7478 CVSS v3.0 Base Score 7.5 | (High) | CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update Service is enabled. ## Remediation These vulnerabilities are fixed in IGSS14 version 14.0.0.20009 and the update is available for download below: http://igss.schneider-electric.com/igss/igssupdates/v140/IGSSUPDATE.zip For IGSS version 13 and prior we recommend updating to IGSS version 14. Schneider Electric Security Notification 10-Mar-20 Document Reference Number – SEVD-2020 -070-01 Page 2 of 4 Alternatively, the following workarounds and mitigations can be applied by customers to reduce the risk: • Disable the IGSS Update service when it is not required installing updates using the service. • Keep the infrastructure offline and do not allow Windows login and network access for untrusted people and sources. ## Product Information

// Vulnerabilities (2)

CVE ID CVSS Score Severity Description
CVE-2020-7478 7.8 high
The affected product could allow a remote unauthenticated attacker to read arbitrary files on the device.CVE-2020-7478 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2020-7479 7.8 high
The affected product could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the IGSS update service.CVE-2020-7479 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

// Affected Products (1)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Software, LLC Schneider Electric Software, LLC IGSS (Interactive Graphical SCADA System) scada_server
L2
--

// Remediations (5)

Mitigation: Keep the infrastructure offline and do not allow Windows login and network access for untrusted peop
Keep the infrastructure offline and do not allow Windows login and network access for untrusted people and sources.
Mitigation: Disable the IGSS Update service when it is not required installing updates using the service.
Disable the IGSS Update service when it is not required installing updates using the service.
Mitigation: Schneider Electric has provided IGSS14 Version 14.0.0.20009 to address these vulnerabilities. Users
Schneider Electric has provided IGSS14 Version 14.0.0.20009 to address these vulnerabilities. Users are recommended to update to IGSS Version 14.
Mitigation: For more information, see the Schneider Electric security notification.
For more information, see the Schneider Electric security notification.
Mitigation: Alternatively, the following workarounds and mitigations can be applied to reduce risk:
Alternatively, the following workarounds and mitigations can be applied to reduce risk:

// References