CVE-2017-9968: A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3...

Security readout for executives and security teams

Schneider Electric IGSS Mobile 3.01 and earlier did not pin certificates when setting up TLS/SSL connections. That can allow a network-positioned attacker to conduct a man-in-the-middle attack. The provided sources do not include CVSS scoring, confirmed exploitation, or detailed business impact. Exposure is limited to organizations using Schneider Electric IGSS Mobile 3.01 or earlier. Risk is most relevant where mobile users connect over networks an attacker could intercept or influence. The bundle does not identify affected back-end systems or later versions. Treat this as a targeted remediation item for sites using IGSS Mobile, not a broad enterprise emergency. The main business concern is trust in mobile communications with industrial monitoring systems. Priority should rise if affected clients are still used on unmanaged or untrusted networks. Mitigation focus: Identify whether IGSS Mobile 3.01 or earlier is deployed.; Review Schneider Electric advisory SEVD-2018-039-02 for vendor remediation guidance.; Prioritize removal or upgrade of affected mobile clients per vendor guidance..

Prepared

Jun 7, 2026, 20:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.