AVEVA Operations Control Logger Execution with Unnecessary Privileges
CVE-2023-33873

7.8HIGH

Key Information:

Vendor

AVEVA

Status
SystemPlatform
Historian
Application Server
InTouch
Vendor
CVE Published:
15 November 2023

What is CVE-2023-33873?

This vulnerability allows an attacker with standard user privileges on a local operating system to escalate their access to System privileges. By exploiting this flaw in AVEVA Software, potential adversaries can gain complete control over the affected machines, posing a serious security risk. Organizations utilizing AVEVA products should prioritize patching and implementing recommended security measures to protect against unauthorized access.

Affected Version(s)

Application Server 0 <= 2020 R2 SP1 P01

Batch Management 0 <= 2020 SP1

Communication Drivers Pack 0 <= 2020 R2 SP1

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-3...
https://www.aveva.com/en/support-and-success/cyber-securi...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lukasz Piotrowski from Equinor reported these vulnerabilities to AVEVA.
.
CVE-2023-33873 : AVEVA Operations Control Logger Execution with Unnecessary Privileges