CVE-2023-1256
CVE-2023-1256

9.8CRITICAL

Key Information:

Vendor

Aveva

Status
Aveva Plant Scada
Aveva Telemetry Server
Vendor
CVE Published:
16 March 2023

What is CVE-2023-1256?

The AVEVA Plant SCADA and AVEVA Telemetry Server exhibit a flaw allowing unauthenticated users to exploit improper authorization. This vulnerability can enable unauthorized individuals to remotely read sensitive data, disrupt services, and manipulate alarm states, posing significant risks to operational integrity. Stakeholders are urged to address this security issue promptly to safeguard their systems.

Affected Version(s)

AVEVA Plant SCADA 2023 Update 10

AVEVA Plant SCADA 2020R2 Update 10

AVEVA Telemetry Server 2020 R2 SP1

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-0...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-1256 : CVE-2023-1256