Lucene search

[email protected]CVE-2020-10608

HistoryJul 24, 2020 - 11:15 p.m.

CVE-2020-10608

2020-07-2423:15:11

CWE-347

[email protected]

web.nvd.nist.gov

osisoft

pi system

cve-2020-10608

code integrity

privilege escalation

information disclosure

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

0.4%

JSON

In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. This exploitation can target another local user of PI System software on the computer to escalate privilege and result in unauthorized information disclosure, deletion, or modification.

Affected configurations

NVD

Node

osisoftpi_apiRange≤1.6.8.26

osisoftpi_apiRange≤2.0.2.5windows_integrated_security

osisoftpi_buffer_subsystemRange≤4.8.0.18

osisoftpi_connectorRange≤1.0.0.54ping

osisoftpi_connectorRange≤1.1.0.10ethernet\/ip

osisoftpi_connectorRange≤1.2.0.6bacnet

osisoftpi_connectorRange≤1.2.0.42dc_systems_rtscada

osisoftpi_connectorRange≤1.2.1.71siemens_simatic_pcs_7

osisoftpi_connectorRange≤1.2.2.79iec_60870-5-104

osisoftpi_connectorRange≤1.3.0.1hart-ip

osisoftpi_connectorRange≤1.3.0.130opc-ua

osisoftpi_connectorRange≤1.3.1.135ufl

osisoftpi_connectorRange≤1.4.0.17cygnet

osisoftpi_connectorRange≤1.5.0.88wonderware_historian

osisoftpi_connector_relayRange≤2.5.19.0

osisoftpi_data_archiveRange≤3.4.430.460

osisoftpi_data_collection_managerRange≤2.5.19.0

osisoftpi_integratorRange≤2.2.0.183business_analytics

osisoftpi_interface_configuration_utilityRange≤1.5.0.7

osisoftpi_to_ocsRange≤1.1.36.0

CPENameOperatorVersion
osisoft:pi_apiosisoft pi apile1.6.8.26
osisoft:pi_apiosisoft pi apile2.0.2.5
osisoft:pi_buffer_subsystemosisoft pi buffer subsystemle4.8.0.18
osisoft:pi_connectorosisoft pi connectorle1.0.0.54
osisoft:pi_connectorosisoft pi connectorle1.1.0.10
osisoft:pi_connectorosisoft pi connectorle1.2.0.6
osisoft:pi_connectorosisoft pi connectorle1.2.0.42
osisoft:pi_connectorosisoft pi connectorle1.2.1.71
osisoft:pi_connectorosisoft pi connectorle1.2.2.79
osisoft:pi_connectorosisoft pi connectorle1.3.0.1

CPE	Name	Operator	Version
osisoft:pi_api	osisoft pi api	le	1.6.8.26
osisoft:pi_api	osisoft pi api	le	2.0.2.5
osisoft:pi_buffer_subsystem	osisoft pi buffer subsystem	le	4.8.0.18
osisoft:pi_connector	osisoft pi connector	le	1.0.0.54
osisoft:pi_connector	osisoft pi connector	le	1.1.0.10
osisoft:pi_connector	osisoft pi connector	le	1.2.0.6
osisoft:pi_connector	osisoft pi connector	le	1.2.0.42
osisoft:pi_connector	osisoft pi connector	le	1.2.1.71
osisoft:pi_connector	osisoft pi connector	le	1.2.2.79
osisoft:pi_connector	osisoft pi connector	le	1.3.0.1

Rows per page:

1-10 of 201

CNA Affected

[
  {
    "product": "OSIsoft PI System multiple products and versions",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "OSIsoft PI System multiple products and versions"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsa-20-133-02

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

0.4%

JSON

Related for CVE-2020-10608

prion1 cvelist1 nvd1 ics1