CVE-2020-7478

HIGH

Interactive Graphical SCADA System < 14.0.0.20009 - Unauthenticated Path Traversal via IGSS Update Service

Title source: llm
STIX 2.1

Description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update Service is enabled.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-20-371/

Scores

CVSS v3 7.5
EPSS 0.0184
EPSS Percentile 83.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-22
Status published
Products (1)
schneider-electric/interactive_graphical_scada_system 14.0 - 14.0.0.20009
Published Mar 23, 2020
Tracked Since Feb 18, 2026