CVE-2021-22823

critical · 9.1

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IGSS due to lack of validation of network messages. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21320 and prior)

9.1

CVSS

21.4%

EPSS (exploit prob.)

97th

EPSS percentile

2022-02-11

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-306

Affected products

Vendor	Product	Affected versions
schneider-electric	interactive_graphical_scada_system_data_collector	<= 15.0.0.21320

Check a specific version with /api/v1/cve/match.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-01
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-01

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-22823