CVE-2020-7478

EUVD-2020-28603
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update Service is enabled.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
Affected Products (NVD)
VendorProductVersion
schneider-electricinteractive_graphical_scada_system
14.0 ≤
𝑥
< 14.0.0.20009
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.se.com/ww/en/download/document/SEVD-2020-070-01/
https://www.zerodayinitiative.com/advisories/ZDI-20-371/
https://www.se.com/ww/en/download/document/SEVD-2020-070-01/
https://www.zerodayinitiative.com/advisories/ZDI-20-371/