description: A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious report file in the IGSS project report directory, this could lead to remote code execution when a victim eventually opens the report. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior)
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
vendor: Schneider Electric
product: IGSS Data Server(IGSSdataServer.exe)
versions:
version: V, status: affected, lessThanOrEqual: 16.0.0.23040, versionType: custom
}
{
vendor: Schneider Electric
product: IGSS Dashboard (DashBoard.exe)
versions:
version: V, status: affected, lessThanOrEqual: 16.0.0.23040, versionType: custom
}
{
vendor: Schneider Electric
product: Custom Reports (RMS16.dll)
versions:
version: V, status: affected, lessThanOrEqual: 16.0.0.23040, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
]