9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.723 High
EPSS
Percentile
98.0%
--------- Begin Update A Part 1 of 6 ---------
--------- End Update A Part 1 of 6 ---------
--------- Begin Update A Part 2 of 6 ---------
--------- End Update A Part 2 of 6 ---------
This updated advisory is a follow-up to the original advisory titled ICSA-22-342-02 AVEVA InTouch Access Anywhere, published December 8, 2022 on the ICS webpage at cisa.gov/topics/industrial-control-systems.
--------- Begin Update A Part 3 of 6 ---------
Successful exploitation of these vulnerabilities could allow an unauthenticated user to read files on the system, execute arbitrary code, or create a denial-of-service condition.
--------- End Update A Part 3 of 6 ---------
--------- Begin Update A Part 4 of 6 ---------
The following versions of AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere—both remote human machine interface (HMI) software—are affected:
--------- End Update A Part 4 of 6 ---------
4.2 VULNERABILITY OVERVIEW
4.2.1 RELATIVE PATH TRAVERSAL CWE-23
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server.
CVE-2022-23854 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
--------- Begin Update A Part 5 of 6 ---------
4.2.2 BUFFER COPY WITHOUT CHECKING SIZE OF INPUT (‘CLASSIC BUFFER OVERFLOW’) CWE-120
AVEVA InTouch Access Anywhere versions 2023 and prior and Plant SCADA Access Anywhere versions 2020 R2 and prior use outdated OpenSSL versions that are vulnerable to a classic buffer overflow, which could allow an attacker to create denial-of-service conditions or execute arbitrary code.
CVE-2021-3711 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
4.2.3 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION (‘CROSS-SITE SCRIPTING’) CWE-79
AVEVA InTouch Access Anywhere versions 2023 and prior and Plant SCADA Access Anywhere versions 2020 R2 and prior use versions of jQuery vulnerable to cross-site scripting. Passing HTML from untrusted sources—even after sanitizing it—to one of jQuery’s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code in jQuery versions greater than or equal to 1.2 and before 3.5.0.
CVE-2020-11022 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
--------- End Update A Part 5 of 6 ---------
4.3 BACKGROUND
Jens Regel of CRISEC reported this vulnerability to AVEVA.
--------- Begin Update A Part 6 of 6 ---------
AVEVA recommends users uninstall their old software and reinstall the following versions:
InTouch Access Anywhere 2023b or later.
Plant SCADA Access Anywhere 2023 or later.
Hotfixes for these vulnerabilities on older software versions are not available.
For additional information, please refer to AVEVA’s security advisory AVEVA-2023-001.
--------- End Update A Part 6 of 6 ---------
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-11022
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3711
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23854
cisa.gov/ics
cisa.gov/ics
cwe.mitre.org/data/definitions/120.html
cwe.mitre.org/data/definitions/23.html
cwe.mitre.org/data/definitions/79.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
softwaresupportsp.aveva.com/#/producthub/details?id=d848918b-c3c3-489d-e439-08dace3d2997
softwaresupportsp.aveva.com/#/producthub/details?id=ddbc4aa0-f607-4226-8625-08dabdf803e9
twitter.com/CISAgov
twitter.com/intent/tweet?text=AVEVA%20InTouch%20Access%20Anywhere%20and%20Plant%20SCADA%20Access%20Anywhere%20%28Update%20A%29+https://www.cisa.gov/news-events/ics-advisories/icsa-22-342-02
us-cert.cisa.gov/ics/Recommended-Practices
us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
www.aveva.com/en/support-and-success/cyber-security-updates/
www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-22-342-02&title=AVEVA%20InTouch%20Access%20Anywhere%20and%20Plant%20SCADA%20Access%20Anywhere%20%28Update%20A%29
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-22-342-02
www.oig.dhs.gov/
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/ics-advisories/icsa-22-342-02
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=AVEVA%20InTouch%20Access%20Anywhere%20and%20Plant%20SCADA%20Access%20Anywhere%20%28Update%20A%29&body=www.cisa.gov/news-events/ics-advisories/icsa-22-342-02
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.723 High
EPSS
Percentile
98.0%