CVE-2023-4516 Missing authorization in IGSS Update Service (IGSSupdateservice.exe)
A local attacker can modify the update source in IGSS Update Service due to missing authentication, potentially leading to remote code execution via malicious updates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4516?
CVE-2023-4516 is a high-severity missing authorization vulnerability in Schneider Electric IGSS Update Service (IGSSupdateservice.exe), published on 14 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker to change update source, potentially leading to remote code execution when the attacker force an update containing malicious content.
Weakness: CWE-306
Which versions are affected by CVE-2023-4516?
It affects 1 product.
Products include Schneider-Electric Interactive Graphical Scada System.
How do I fix CVE-2023-4516?
No fix has been published for CVE-2023-4516 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-4516 being exploited?
There is no known exploitation of CVE-2023-4516 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric IGSS Update Service (IGSSupdateservice.exe)
- CVE-2013-0657 Memory corruption in n/a
- CVE-2022-2329 Integer overflow in IGSS Data Server (IGSSdataServer.exe)
- CVE-2022-24324 Memory corruption in IGSS Data Server (IGSSdataServer.exe)
- CVE-2022-32522 Memory corruption in IGSS Data Server (IGSSdataServer.exe)
- CVE-2022-32523 Memory corruption in IGSS Data Server (IGSSdataServer.exe)
Sources
Also known as GHSA-4c87-xqpv-r7h5.