CVE-2023-4516

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker to change update source, potentially leading to remote code execution when the attacker force an update containing malicious content.

Score

CVSS 3.1 7.8 High

Status

Modified - cybersecurity@se.com

Published

2023-09-14

Last modified

2025-02-27

Weaknesses

CWE-306

Affected products

• Interactive Graphical Scada System (Schneider-electric)
• Igss Update Service Igssupdateservice.exe (Schneider Electric)

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-255-01&p_enDocType=Security+and+Safety+Notice&p_File_…