IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2020-315-03 — Interactive Graphical SCADA System (IGSS) (V1.1)

HIGH
CVSS 7.8
Date 2026-10-16T20:41:35+00:00
Source schneider-electric
Published by Schneider Electric

// Description

Schneider Electric Security Notification 10-Nov-20 (15-Apr-21) Document Reference Number – SEVD-2020-315-03 V1.1 Page 1 of 5 ## Interactive Graphical SCADA System (IGSS) (V1.1) 10 November 2020 (15 April 2021) # Overview Schneider Electric is aware of multiple vulnerabilities in the Interactive Graphical SCADA System (IGSS) product. The IGSS product is a state-of-the art SCADA system used for monitoring and controlling industrial processes. IGSS communicates with all major industry standard PLC drivers. Failure to apply the remediations provided below may risk remote code execution, which could result in an attacker gaining access to the Windows Operating System on the machine used to import CGF files, typically a step performed during system design time. # Affected Product and Versions IGSS Definition (Def.exe) version s 14.0.0.20247 and prior # Vulnerability Details CVE ID: CVE-2020-7550 CVSS v3.0 Base Score 7.8 | High | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. CVE ID: CVE-2020-7551 CVSS v3.0 Base Score 7.8 | High | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H A CWE-787: Out-of-bounds Write vulnerability exists that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. CVE ID: CVE-2020-7552 CVSS v3.0 Base Score 7.8 | High | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H A CWE-787: Out-of-bounds Write vulnerability exists that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. Schneider Electric Security Notification 10-Nov-20 (15-Apr-21) Document Reference Number – SEVD-2020-315-03 V1.1 Page 2 of 5 CVE ID: CVE-2020-7553

// Vulnerabilities (9)

CVE ID CVSS Score Severity Description
CVE-2020-7555 7.8 high
An out-of-bounds write vulnerability could cause remote code execution when a malicious CGF (Configuration Group File) file is imported to IGSS Definition.CVE-2020-7555 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2020-7553 7.8 high
An out-of-bounds write vulnerability could cause remote code execution when a malicious CGF (Configuration Group File) is imported to IGSS Definition.CVE-2020-7553 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2020-7558 7.8 high
An out-of-bounds write vulnerability could cause remote code execution when a malicious CGF (Configuration Group File) is imported to IGSS Definition.CVE-2020-7558 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2020-7557 7.8 high
An out-of-bounds read vulnerability could cause remote code execution when a malicious CGF (Configuration Group File) is imported to IGSS Definition.CVE-2020-7557 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2020-7556 7.8 high
An out-of-bounds write vulnerability could cause remote code execution when a malicious CGF (Configuration Group File) is imported to IGSS Definition.CVE-2020-7556 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2020-7550 7.8 high
An improper restriction of operations within the bounds of a memory buffer vulnerability could cause remote code execution when a malicious CGF (Configuration Group File) is imported to IGSS Definition.CVE-2020-7550 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2020-7551 7.8 high
An improper restriction of operations within the bounds of a memory buffer vulnerability could cause remote code execution when a malicious CGF (Configuration Group File) is imported to IGSS Definition.CVE-2020-7551 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2020-7552 7.8 high
An improper restriction of operations within the bounds of a memory buffer vulnerability could cause remote code execution when a malicious CGF (Configuration Group File) is imported to IGSS Definition.CVE-2020-7552 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2020-7554 7.8 high
An improper restriction of operations within the bounds of a memory buffer vulnerability could cause remote code execution when a malicious CGF (Configuration Group File) is imported to IGSS Definition.CVE-2020-7554 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

// Remediations (4)

Mitigation: Users should also consider upgrading to the latest product offering IGSS v15 to resolve this issue.
Users should also consider upgrading to the latest product offering IGSS v15 to resolve this issue.
Mitigation: For more information, see Schneider Electric security notification SEVD-2020-315-03
For more information, see Schneider Electric security notification SEVD-2020-315-03
Mitigation: Avoid importing CGF files from untrusted sources
Avoid importing CGF files from untrusted sources
Mitigation: Schneider Electric has provided a new version of the IGSS Definition module to address these vulnera
Schneider Electric has provided a new version of the IGSS Definition module to address these vulnerabilities. Users are recommended to update to IGSS Version 14.0.0.20248

// References