IGSS (Interactive Graphical SCADA System)

An attacker could execute arbitrary code on the IGSS Data Collector, gaining control of the Windows machine running SCADA monitoring and process control logic. This could disrupt real-time monitoring of industrial processes or allow manipulation of control commands sent to PLCs.

Water utilities, electric utilities, and manufacturing facilities using Schneider Electric IGSS for industrial process monitoring and control. This impacts any organization relying on IGSS Data Collector for SCADA operations, particularly those in energy and manufacturing sectors that depend on real-time process visibility and PLC communication.

An attacker with network access to the Data Collector can send a malicious request exploiting the buffer overflow or file upload vulnerability without authentication. Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the process running dc.exe, typically SYSTEM or a privileged service account.