7.8high
CVE-2017-9967
A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 32%
Public exploits
0
none known
Summary
A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. Security configuration settings such as Address Space Layout Randomization (ASLR) and Data Execution prevention (DEP) were not properly configured resulting in weak security.
Exploit prediction (EPSS)
0.38% probability of exploitation in the next 30 days, higher than 32% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
References
- schneider-electric.com /en/download/document/SEVD-2018-037-01/ · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/103022 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-9967
- NVD: CVE-2017-9967
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.