TI-2023-12567 Aliases CVE-2023-27977 GHSA-8c9m-95jr-9f2r

Insufficient verification of data authenticity in Schneider Electric IGSS Data Server

LOW 34CWE-345Published 2023-03-21 · Updated 2025-02-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in the IGSS project report directory, this could lead to loss of data when an attacker sends specific crafted messages to the Data Server TCP port. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00243 15th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Schneider Electric	IGSS Data Server(IGSSdataServer.exe)	V – 16.0.0.23040	—	No fix listed	CNA
Schneider Electric	IGSS Dashboard (DashBoard.exe)	V – 16.0.0.23040	—	No fix listed	CNA
Schneider Electric	Custom Reports (RMS16.dll)	V – 16.0.0.23040	—	No fix listed	CNA

IGSS Data Server(IGSSdataServer.exe) VendorSchneider Electric Affected V – 16.0.0.23040 Fixed in — No fix listed CNA
IGSS Dashboard (DashBoard.exe) VendorSchneider Electric Affected V – 16.0.0.23040 Fixed in — No fix listed CNA
Custom Reports (RMS16.dll) VendorSchneider Electric Affected V – 16.0.0.23040 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:schneider-electric:custom_reports::::::::	up to 16.0.0.23040	Vulnerable	Schneider Electric
cpe:2.3:a:schneider-electric:igss_dashboard::::::::	up to 16.0.0.23040	Vulnerable	Schneider Electric
cpe:2.3:a:schneider-electric:igss_data_server::::::::	up to 16.0.0.23040	Vulnerable	Schneider Electric

cpe:2.3:a:schneider-electric:custom_reports:*:*:*:*:*:*:*:* Versions up to 16.0.0.23040 Vulnerable ·Schneider Electric
cpe:2.3:a:schneider-electric:igss_dashboard:*:*:*:*:*:*:*:* Versions up to 16.0.0.23040 Vulnerable ·Schneider Electric
cpe:2.3:a:schneider-electric:igss_data_server:*:*:*:*:*:*:*:* Versions up to 16.0.0.23040 Vulnerable ·Schneider Electric

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-27977
2026-10-03 Alias added: GHSA-8c9m-95jr-9f2r

References

Patch 1

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf

TI-2023-12568 Deserialization of untrusted data in Schneider Electric IGSS Data Server CVSS 3.1HIGH 7.8
TI-2023-12570 Missing authentication in Schneider Electric IGSS Data Server CVSS 3.1HIGH 8.8
TI-2023-12574 Improper input validation in Schneider Electric IGSS Data Server CVSS 3.1HIGH 8.8
TI-2023-12571 Path traversal in Schneider Electric IGSS Data Server CVSS 3.1HIGH 8.8
TI-2023-12572 Insufficient verification of data authenticity in Schneider Electric IGSS Data Server CVSS 3.1HIGH 8.8
TI-2023-12573 Missing authentication in Schneider Electric IGSS Data Server CVSS 3.1MEDIUM 6.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences