IGSS (Interactive Graphical SCADA System)

An authenticated local attacker could exploit path traversal and improper access control vulnerabilities in the IGSSupdate service to read arbitrary files or execute commands on the SCADA system, potentially altering process parameters or disrupting production operations.

This affects energy sector operators and any facility running IGSS (Interactive Graphical SCADA System) for process monitoring and control. IGSS is commonly used in power generation, distribution, and manufacturing environments to manage critical process operations. Organizations using IGSS version 14 or earlier with the IGSSupdate service active are at risk.

An attacker with local access to a machine running IGSS could interact with the IGSSupdate service. By crafting malicious requests that exploit path traversal (CWE-22) and missing access controls (CWE-306), the attacker could access files outside the intended directory structure or bypass authentication checks to execute arbitrary operations on the SCADA system.