IM
IronMonkey Threat Research
‹ Back to ICS Advisories

IGSS (Interactive Graphical SCADA System)

HIGH
CVSS 7.8
Date 2026-10-16T20:40:33+00:00
Source schneider-electric
Published by Schneider Electric

// Description

Schneider Electric Security Notification 8-Jun-21 Document Reference Number – SEVD-2021 -159-01 Page 1 of 6 # IGSS (Interactive Graphical SCADA System) 8 June 2021 ## Overview Schneider Electric is aware of multiple vulnerabilities in the Interactive Graphical SCADA System (IGSS) product. The IGSS product is a state-of-the art SCADA system used for monitoring and controlling industrial processes. IGSS communicates with all major industry standard PLC drivers. Failure to apply the remediations provided below may risk remote code execution, which could result in an attacker gaining access to the Windows Operating System on the machine used to import CGF and WSP files, typically a step performed during system design time. ## Affected Product and Versions CVE Product and Versions CVE-2021-22750 IGSS Definition (Def.exe) V15.0.0.21041 and prior CVE-2021-22751 IGSS Definition (Def.exe) V15.0.0.21140 and prior CVE-2021-22752 CVE-2021-22753 CVE-2021-22754 CVE-2021-22755 CVE-2021-22756 CVE-2021-22757 CVE-2021-22758 CVE-2021-22759 CVE-2021-22760 CVE-2021-22761 CVE-2021-22762 ## Vulnerability Details CVE ID: CVE-2021-22750 CVSS v3.1 Base Score 7.8 | High | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H A CWE-787: Out-of-bounds write vulnerability exists that could result in loss of data or remote code execution due to missing length checks, when a malicious CGF file is imported to IGSS Definition. Schneider Electric Security Notification 8-Jun-21 Document Reference Number – SEVD-2021 -159-01 Page 2 of 6 CVE ID: CVE-2021-22751 CVSS v3.1 Base Score 7.8 | High | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H A CWE-787: Out-of-bounds write vulnerability exists that could result in disclosure of information or execution of arbitrary code due to lack of input validation, when a malicious CGF (Configuration Group File) file is imported to IGSS Definition. CVE ID: CVE-2021-22752

// Vulnerabilities (13)

CVE ID CVSS Score Severity Description
CVE-2021-22757 7.8 high
Exploitation of this vulnerability could result in disclosure of information or remote code execution due to lack of validation on user-supplied input data when a malicious CGF file is imported to IGSS Definition.CVE-2021-22757 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22762 7.8 high
Exploitation of this vulnerability could result in remote code execution when a malicious CGF or WSP file is being parsed by IGSS Definition.CVE-2021-22762 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22756 7.8 high
Exploitation of this vulnerability could result in disclosure of information or remote code execution due to lack of user-supplied data validation when a malicious CGF file is imported to IGSS Definition.CVE-2021-22756 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22754 7.8 high
Exploitation of this vulnerability could result in loss of data or remote code execution due to lack of proper validation of user-supplied data when a malicious CGF file is imported to IGSS Definition.CVE-2021-22754 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22750 7.8 high
Exploitation of this vulnerability could result in loss of data or remote code execution due to missing length checks when a malicious CGF file is imported to IGSS Definition.CVE-2021-22750 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22751 7.8 high
Exploitation of this vulnerability could result in disclosure of information or execution of arbitrary code due to lack of input validation when a malicious CGF (Configuration Group File) is imported to IGSS Definition.CVE-2021-22751 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22752 7.8 high
Exploitation of this vulnerability could result in loss of data or remote code execution due to missing size checks when a malicious WSP (Workspace) file is being parsed by IGSS Definition.CVE-2021-22752 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22753 7.8 high
Exploitation of this vulnerability could result in loss of data or remote code execution due to missing length checks when a malicious WSP file is being parsed by IGSS Definition.CVE-2021-22753 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22760 7.8 high
Exploitation of this vulnerability could result in loss of data or remote code execution due to missing checks of user-supplied input data when a malicious CGF file is imported to IGSS Definition.CVE-2021-22760 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22759 7.8 high
Exploitation of this vulnerability could result in loss of data or remote code execution due to use of unchecked input data when a malicious CGF file is imported to IGSS Definition.CVE-2021-22759 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22761 7.8 high
Exploitation of this vulnerability could result in disclosure of information or remote code execution due to missing length check on user supplied data when a malicious CGF file is imported to IGSS Definition.CVE-2021-22761 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22758 7.8 high
Exploitation of this vulnerability could result in loss of data or remote code execution due to lack of validation of user-supplied input data when a malicious CGF file is imported to IGSS Definition.CVE-2021-22758 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22755 7.8 high
Exploitation of this vulnerability could result in disclosure of information or remote code execution due to lack of sanity checks on user-supplied data when a malicious CGF file is imported to IGSS Definition.CVE-2021-22755 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

// Remediations (4)

Mitigation: Schneider Electric recommends users update to Version 15.0.0.21141 of the IGSS Definition module: De
Schneider Electric recommends users update to Version 15.0.0.21141 of the IGSS Definition module: Def.exe includes fixes for these vulnerabilities and is available for download through IGSS Master > Update IGSS Software, or at the link above.
Mitigation: If users choose not to apply the remediation provided above, they should immediately apply the follo
If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploitation:
Mitigation: Avoid importing CGF and WSP files from untrusted sources.
Avoid importing CGF and WSP files from untrusted sources.
Mitigation: Please see Schneider Electric's publication SEVD-2021-159-01 for more information.
Please see Schneider Electric's publication SEVD-2021-159-01 for more information.

// References