CVE-2020-7558

Vulnerability

A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247. The flaw occurs during the parsing of CGF (Configuration Group File) files when user-supplied data is not properly validated, leading to a write past the end of an allocated data structure [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious CGF file and convincing a user to open it, for example by visiting a malicious page or opening the file in IGSS Definition. The attacker does not need prior authentication or network access to the system, but user interaction is required [1].

Impact

Successful exploitation could allow an attacker to execute arbitrary code within the context of the current process. This can lead to full compromise of confidentiality, integrity, and availability of the affected system, with a CVSS score of 7.8 (High) [1].

Mitigation

Schneider Electric has released a fix in IGSS version 14.0.0.20247 or later. Users should update to the latest version. No workaround is provided in the available references [1].