CVE-2017-6033: schneider-electric interactive_graphical_scada_system Uncontrolled Search Path Element

Vulnerability summary

CVE-2017-6033 is a high (CVSS 7.8) Uncontrolled Search Path Element vulnerability in schneider-electric interactive_graphical_scada_system. EPSS estimates a 1.34% chance of exploitation in the next 30 days, higher than 70.9% of scored vulnerabilities.

Timeline

1. 07-04-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

A DLL Hijacking issue was discovered in Schneider Electric Interactive Graphical SCADA System (IGSS) Software, Version 12 and previous versions. The software will execute a malicious file if it is named the same as a legitimate file and placed in a location that is earlier in the search path.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.