Skip to content
OpenAdvisories
High ICSA-23-318-01 2 CVEs

AVEVA Operations Control Logger

Published Nov 14, 2023 · Updated Nov 14, 2023

Vendor: AVEVA Product: Application Server Product: Batch Management Product: Communication Drivers Pack Product: Edge (formerly known as Indusoft Web Studio) Product: Enterprise Licensing (formerly known as License Manager) Product: Historian Product: InTouch Product: Manufacturing Execution System (formerly known as Wonderware MES) Product: Mobile Operator (formerly known as IntelaTrac Mobile Operator Rounds) Product: Plant SCADA (formerly known as Citect) Product: Recipe Management Product: SystemPlatform Product: Telemetry Server Product: Worktasks (formerly known as Workflow Management)

Summary

Successful exploitation of these vulnerabilities could allow privilege escalation or denial of service.

Vulnerabilities 2

  • High 7.8
    CVE-2023-33873

    AVEVA Operations Control Logger Execution with Unnecessary Privileges

    This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.

    AVEVA InTouch Application Server Historian Browsers
  • Medium 5.5
    CVE-2023-34982

    AVEVA Operations Control Logger External Control of File Name or Path

    This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service.

    AVEVA InTouch Application Server Historian Browsers

Revision history

  1. #1

    Initial Publication

References