Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-32506 State: PUBLISHED Published: 2024-05-09T19:47:03.879Z Last Updated: 2025-02-13T15:46:25.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to the circuit board could use the SWD debug features to control the execution of code on the processor and debug the firmware, as well as read or alter the content of the internal and external flash memory. This affects Nuki Smart Lock 3.0 before 3.3.5, Nuki Smart Lock 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
dge v1 before 1.22.0 and v2 before 2.13.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/ - https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/ - https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/ - https://nuki.io/en/security-updates/
CVE ID: CVE-2022-32507 State: PUBLISHED Published: 2024-05-09T19:39:59.187Z Last Updated: 2025-02-13T15:46:26.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain Nuki Home Solutions devices. Some BLE commands, which should have been designed to be only called from privileged accounts, could also be called from unprivileged accounts. This demonstrates that no access controls were implemented for the different BLE commands across the different accounts. This affects Nuki Smart Lock 3.0 before 3.3.5 and Nuki Smart Lock 2.0 before 2.12.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.nccgr
2.12.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/ - https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/ - https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/ - https://nuki.io/en/security-updates/
CVE ID: CVE-2022-32508 State: PUBLISHED Published: 2024-05-09T19:49:11.826Z Last Updated: 2025-02-13T15:46:27.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain Nuki Home Solutions devices. By sending a malformed HTTP verb, it is possible to force a reboot of the device. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-c
ve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/ - https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/ - https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/ - https://nuki.io/en/security-updates/
CVE ID: CVE-2022-32509 State: PUBLISHED Published: 2024-05-09T19:30:06.236Z Last Updated: 2025-02-13T15:46:28.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain Nuki Home Solutions devices. Lack of certificate validation on HTTP communications allows attackers to intercept and tamper data. This affects Nuki Smart Lock 3.0 before 3.3.5, Nuki Bridge v1 before 1.22.0 and Nuki Bridge v2 before 2.13.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32
technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/ - https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/ - https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/ - https://nuki.io/en/security-updates/
CVE ID: CVE-2022-32510 State: PUBLISHED Published: 2024-05-09T19:44:23.117Z Last Updated: 2025-02-13T15:46:28.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative interface. A token can be easily eavesdropped by a malicious actor to impersonate a legitimate user and gain access to the full set of API endpoints. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.nccgroup.com/2022/07/25/technical-advisory-multiple
m Container: - CISA ADP Vulnrichment: References: - https://research.nccgroup.com/2022/07/25/technical-advisory-multiple-vulnerabilities-in-nuki-smart-locks-cve-2022-32509-cve-2022-32504-cve-2022-32502-cve-2022-32507-cve-2022-32503-cve-2022-32510-cve-2022-32506-cve-2022-32508-cve-2/ - https://www.hackread.com/nuki-smart-locks-vulnerabilities-plethora-attack-options/ - https://latesthackingnews.com/2022/07/28/multiple-security-flaws-found-in-nuki-smart-locks/ - https://nuki.io/en/security-updates/
CVE ID: CVE-2022-32511 State: PUBLISHED Published: 2022-06-06T21:55:11 Last Updated: 2024-08-03T07:46:43.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jmespath/jmespath.rb/pull/55 - https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1 - https://stackoverflow.com/a/30050571/580231 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5/ - https://lists.fedoraproject.org/archives/list/package-announ
doraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP/
CVE ID: CVE-2022-32512 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:08:42.167Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Schneider Electric Products: CanBRASS Problem Types: CWE-119 Description: A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause remote code execution when a command which exploits this vulnerability is utilized. Affected Products: CanBRASS (Versions prior to V7.5.1) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+N
: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-07_CanBRASS_Security_Notification.pdf&p_Doc_Ref=SEVD-2022-165-07
CVE ID: CVE-2022-32513 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:18:33.992Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: C-Bus Network Automation Controller, LSS5500NAC, Wiser for C-Bus Automation Controller, LSS5500SHAC, Clipsal C-Bus Network Automation Controller, 5500NAC, Clipsal Wiser for C-Bus Automation Controller, 5500SHAC, SpaceLogic C-Bus Network Automation Controller, 5500NAC2, SpaceLogic C-Bus Application Controller, 5500AC2 Problem Types: CWE-521 Description: A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device
n: A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the password. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0), Wiser for C-Bus Automation Controller - LSS5500SHAC (Versions prior to V1.10.0), Clipsal C-Bus Network Automation Controller - 5500NAC (Versions prior to V1.10.0), Clipsal Wiser for C-Bus Automation Controller - 5500SHAC (Versions prior to V1.10.0), SpaceLogic C-Bus Network Automation Controller - 5500NAC2 (Versions prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0) Additional Analyst Not
prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-06_C-Bus_Home_Automation_Products_Security_Notification.pdf
CVE ID: CVE-2022-32514 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:18:27.254Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: C-Bus Network Automation Controller, LSS5500NAC, Wiser for C-Bus Automation Controller, LSS5500SHAC, Clipsal C-Bus Network Automation Controller, 5500NAC, Clipsal Wiser for C-Bus Automation Controller, 5500SHAC, SpaceLogic C-Bus Network Automation Controller, 5500NAC2, SpaceLogic C-Bus Application Controller, 5500AC2 Problem Types: CWE-287 Description: A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device wh
n: A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0), Wiser for C-Bus Automation Controller - LSS5500SHAC (Versions prior to V1.10.0), Clipsal C-Bus Network Automation Controller - 5500NAC (Versions prior to V1.10.0), Clipsal Wiser for C-Bus Automation Controller - 5500SHAC (Versions prior to V1.10.0), SpaceLogic C-Bus Network Automation Controller - 5500NAC2 (Versions prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0) Additional Analyst Notes: - CVE Program
, SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-06_C-Bus_Home_Automation_Products_Security_Notification.pdf
CVE ID: CVE-2022-32515 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:08:34.356Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Schneider Electric Products: Conext™ ComBox Problem Types: CWE-307 Description: A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account when the product does not implement a rate limit mechanism on the admin authentication form. Affected Products: Conext™ ComBox (All Versions) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-03_ConextCombox_Security_Notification.pdf
CVE ID: CVE-2022-32516 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:08:26.260Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: Conext™ ComBox Problem Types: CWE-352 Description: A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop when the product suffers from POST-Based Cross-Site Request Forgery (CSRF). Affected Products: Conext™ ComBox (All Versions) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and
Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-03_ConextCombox_Security_Notification.pdf
CVE ID: CVE-2022-32517 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:08:16.694Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Schneider Electric Products: Conext™ ComBox Problem Types: CWE-1021 Description: A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface user/admin into interacting with the application in an unintended way when the product does not implement restrictions on the ability to render within frames on external addresses. Affected Products: Conext™ ComBox (All Versions) Additional Analyst Notes: - CVE Program Container: -
ternal addresses. Affected Products: Conext™ ComBox (All Versions) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-03_ConextCombox_Security_Notification.pdf
CVE ID: CVE-2022-32518 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:08:08.814Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Data Center Expert Problem Types: CWE-522 Description: A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. This CVE is unique from CVE-2022-32520. Affected Products: Data Center Expert (Versions prior to V7.9.0) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-04_+Data_Center_Expert_Security_Notification.pdf&p_Doc_Ref=SEVD-2022-165-04
CVE ID: CVE-2022-32519 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:07:58.690Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Data Center Expert Problem Types: CWE-257 Description: A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. Affected Products: Data Center Expert (Versions prior to V7.9.0) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Not
- CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-04_+Data_Center_Expert_Security_Notification.pdf&p_Doc_Ref=SEVD-2022-165-04
CVE ID: CVE-2022-32520 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:07:51.671Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Data Center Expert Problem Types: CWE-522 Description: A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. This CVE is unique from CVE-2022-32518. Affected Products: Data Center Expert (Versions prior to V7.9.0) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?
CVE ID: CVE-2022-32521 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:07:44.700Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Data Center Expert Problem Types: CWE-502 Description: A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server. Affected Products: Data Center Expert (Versions prior to V7.9.0) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+N
: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-04_+Data_Center_Expert_Security_Notification.pdf&p_Doc_Ref=SEVD-2022-165-04
CVE ID: CVE-2022-32522 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:18:19.794Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server (IGSSdataServer.exe) Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted mathematically reduced data request messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: -
Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-01_IGSS_Security_Notification_V2.pdf
CVE ID: CVE-2022-32523 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:18:12.115Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server (IGSSdataServer.exe) Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted online data request messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
GSSdataServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-01_IGSS_Security_Notification_V2.pdf
CVE ID: CVE-2022-32524 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:18:04.323Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server (IGSSdataServer.exe) Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted time reduced data messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
SdataServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-01_IGSS_Security_Notification_V2.pdf
CVE ID: CVE-2022-32525 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:17:54.890Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server (IGSSdataServer.exe) Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted alarm data messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
rver.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-01_IGSS_Security_Notification_V2.pdf
CVE ID: CVE-2022-32526 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:17:48.134Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server (IGSSdataServer.exe) Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted setting value messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
aServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-01_IGSS_Security_Notification_V2.pdf
CVE ID: CVE-2022-32527 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:17:39.968Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server (IGSSdataServer.exe) Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted alarm cache data messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
dataServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-01_IGSS_Security_Notification_V2.pdf
CVE ID: CVE-2022-32528 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:07:38.231Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Schneider Electric Products: IGSS Data Server (IGSSdataServer.exe) Problem Types: CWE-306 Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files in the IGSS project report directory, potentially leading to a denial-of-service condition when an attacker sends specific messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) Additional Analyst Notes: - CVE Program