Skip to content
OpenAdvisories
High ICSA-20-133-02 10 CVEs

OSIsoft PI System (Update A)

Published May 12, 2020 · Updated Jun 9, 2020 · Revision 2

Vendor: OSIsoft Product: Applications using PI Asset Framework (AF) Client Product: Applications using PI Software Development Kit (SDK) Product: PI API Product: PI API for Windows Integrated Security Product: PI Buffer Subsystem Product: PI Connector for BACnet Product: PI Connector for CygNet Product: PI Connector for DC Systems RTscada Product: PI Connector for Ethernet/IP Product: PI Connector for HART-IP Product: PI Connector for IEC 60870-5-104 versions Product: PI Connector for OPC-UA Product: PI Connector for Ping Product: PI Connector for Siemens Simatic PCS 7 Product: PI Connector for UFL Product: PI Connector for Wonderware Historian Product: PI Connector Relay Product: PI Data Archive Product: PI Data Collection Manager Product: PI Integrator for Business Analytics Product: PI Interface Configuration Utility (ICU) Product: PI Manual Logger Product: PI to OCS Product: PI Vision Product: RtReports

Summary

Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized information, delete or modify local processes, and crash the affected device.

Vulnerabilities 10

  • High 7.5
    CVE-2019-10768

    angular Prototype Pollution vulnerability

    In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.

    angular.js angular.js angular Debian Ubuntu npm
  • Medium 6.5
    CVE-2020-10643

    OSIsoft PI System

    An authenticated remote attacker could use specially crafted URLs to send a victim using PI Vision 2019 mobile to a vulnerable web page due to a known issue in a third-party component.

    OSIsoft PI Vision
  • Medium 5.9
    CVE-2020-10600

    OSIsoft PI System

    An authenticated remote attacker could crash PI Archive Subsystem when the subsystem is working under memory pressure. This can result in blocking queries to PI Data Archive (2018 SP2 and prior versions).

    OSIsoft PI Data Archive
  • Unscored —
    CVE-2019-18244

    In OSIsoft PI System multiple products and versions, a local attacker could view sensitive information in log files whe…

  • Unscored —
    CVE-2020-10602

    In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager du…

  • Unscored —
    CVE-2020-10604

    In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager …

  • Unscored —
    CVE-2020-10606

    In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected…

  • Unscored —
    CVE-2020-10608

    In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity ch…

  • Unscored —
    CVE-2020-10610

    In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to ex…

  • Unscored —
    CVE-2020-10614

    In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision da…

Revision history

  1. #2

    ICSA-20-133-02 OSIsoft PI System (Update A)

  2. #1

    ICSA-20-133-02 OSIsoft PI System

References