Schneider Clears SCADA Software Issue
Tuesday, April 4, 2017 @ 05:04 PM gHale
Schneider Electric recommends a Windows upgrade to mitigate a DLL hijacking vulnerability in its Interactive Graphical SCADA System (IGSS) Software, according to a report with ICS-CERT.
IGSS Software, Version 12 and previous versions suffer from the issue, discovered by Karn Ganeshen.
An attacker who exploits this vulnerability may be able to remotely execute arbitrary code.
In the uncontrolled search path element, the software will execute a malicious file if it is named the same as a legitimate file and placed in a location that is earlier in the search path.
CVE-2017-6033 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 6.8.
No known public exploits specifically target this vulnerability. This vulnerability requires user interaction or social engineering to exploit. However, an attacker with low skill level would be able to leverage the vulnerability.
The product sees action in the critical manufacturing and energy sectors. It also sees use on a global basis.
Schneider Electric recommends users upgrade to Windows 10 to mitigate this vulnerability. Windows 10 enforces a fixed path to the DLL.
More information can be found by visiting Schneider Electric’s security notification number SEVD-2017-090-01.
Leave a Reply
You must be logged in to post a comment.