Lucene search

[email protected]CVE-2020-10610

HistoryJul 24, 2020 - 11:15 p.m.

CVE-2020-10610

2020-07-2423:15:11

CWE-426

CWE-427

[email protected]

web.nvd.nist.gov

osisoft

pi system

cve-2020-10610

exploit

unauthorized access

information disclosure

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.6%

JSON

In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification.

Affected configurations

NVD

Node

osisoftpi_apiRange≤1.6.8.26

osisoftpi_apiRange≤2.0.2.5windows_integrated_security

osisoftpi_buffer_subsystemRange≤4.8.0.18

osisoftpi_connectorRange≤1.0.0.54ping

osisoftpi_connectorRange≤1.1.0.10ethernet\/ip

osisoftpi_connectorRange≤1.2.0.6bacnet

osisoftpi_connectorRange≤1.2.0.42dc_systems_rtscada

osisoftpi_connectorRange≤1.2.1.71siemens_simatic_pcs_7

osisoftpi_connectorRange≤1.2.2.79iec_60870-5-104

osisoftpi_connectorRange≤1.3.0.1hart-ip

osisoftpi_connectorRange≤1.3.0.130opc-ua

osisoftpi_connectorRange≤1.3.1.135ufl

osisoftpi_connectorRange≤1.4.0.17cygnet

osisoftpi_connectorRange≤1.5.0.88wonderware_historian

osisoftpi_connector_relayRange≤2.5.19.0

osisoftpi_data_archiveRange≤3.4.430.460

osisoftpi_data_collection_managerRange≤2.5.19.0

osisoftpi_integratorRange≤2.2.0.183business_analytics

osisoftpi_interface_configuration_utilityRange≤1.5.0.7

osisoftpi_to_ocsRange≤1.1.36.0

CPENameOperatorVersion
osisoft:pi_apiosisoft pi apile1.6.8.26
osisoft:pi_apiosisoft pi apile2.0.2.5
osisoft:pi_buffer_subsystemosisoft pi buffer subsystemle4.8.0.18
osisoft:pi_connectorosisoft pi connectorle1.0.0.54
osisoft:pi_connectorosisoft pi connectorle1.1.0.10
osisoft:pi_connectorosisoft pi connectorle1.2.0.6
osisoft:pi_connectorosisoft pi connectorle1.2.0.42
osisoft:pi_connectorosisoft pi connectorle1.2.1.71
osisoft:pi_connectorosisoft pi connectorle1.2.2.79
osisoft:pi_connectorosisoft pi connectorle1.3.0.1

CPE	Name	Operator	Version
osisoft:pi_api	osisoft pi api	le	1.6.8.26
osisoft:pi_api	osisoft pi api	le	2.0.2.5
osisoft:pi_buffer_subsystem	osisoft pi buffer subsystem	le	4.8.0.18
osisoft:pi_connector	osisoft pi connector	le	1.0.0.54
osisoft:pi_connector	osisoft pi connector	le	1.1.0.10
osisoft:pi_connector	osisoft pi connector	le	1.2.0.6
osisoft:pi_connector	osisoft pi connector	le	1.2.0.42
osisoft:pi_connector	osisoft pi connector	le	1.2.1.71
osisoft:pi_connector	osisoft pi connector	le	1.2.2.79
osisoft:pi_connector	osisoft pi connector	le	1.3.0.1

Rows per page:

1-10 of 201

CNA Affected

[
  {
    "product": "OSIsoft PI System multiple products and versions",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "OSIsoft PI System multiple products and versions"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsa-20-133-02

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.6%

JSON

Related for CVE-2020-10610

cvelist1 prion1 nvd1 ics1