TI-2021-05593 Aliases CVE-2021-22711 GHSA-27cr-vrc4-8c94

Memory corruption in Interactive Graphical SCADA System Definition V15.0.0.21041 and prior

LOW 36CWE-119Published 2021-03-11 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior, which could result in arbitrary read or write conditions when malicious CGF (Configuration Group File) file is imported to IGSS Definition due to missing validation of input data.

Why it matters now

EPSS 0.00883 59th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior	Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior	—	No fix listed	CNA

Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior Vendor— Affected Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:schneider-electric:interactive_graphical_scada_system::::::::	up to 15.0.0.21041	Vulnerable	Schneider Electric

cpe:2.3:a:schneider-electric:interactive_graphical_scada_system:*:*:*:*:*:*:*:* Versions up to 15.0.0.21041 Vulnerable ·Schneider Electric

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-22711
2026-10-03 Alias added: GHSA-27cr-vrc4-8c94

References

Patch 1

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-068-01

Advisory 1

https://www.se.com/ww/en/download/document/SEVD-2021-068-01

TI-2013-00550 Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System… CVSS 2.0HIGH 10.0
TI-2022-02151 Integer overflow in Schneider Electric IGSS Data Server CVSS 3.1CRITICAL 9.8
TI-2022-14164 Buffer overflow in Schneider Electric IGSS Data Server CVSS 3.1CRITICAL 9.8
TI-2022-14162 Buffer overflow in Schneider Electric IGSS Data Server CVSS 3.1CRITICAL 9.8
TI-2022-14161 Buffer overflow in Schneider Electric IGSS Data Server CVSS 3.1CRITICAL 9.8
TI-2022-14160 Buffer overflow in Schneider Electric IGSS Data Server CVSS 3.1CRITICAL 9.8

See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences