Description
This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AVEVA | SystemPlatform | ≤ 2020 R2 SP1 P01 | — |
| AVEVA | Historian | ≤ 2020 R2 SP1 P01 | — |
| AVEVA | Application Server | ≤ 2020 R2 SP1 P01 | — |
| AVEVA | InTouch | ≤ 2020 R2 SP1 P01 | — |
| AVEVA | Enterprise Licensing (formerly known as License Manager) | ≤ 3.7.002 | — |
| AVEVA | Manufacturing Execution System (formerly known as Wonderware MES) | ≤ 2020 P01 | — |
| AVEVA | Recipe Management | ≤ 2020 R2 Update 1 Patch 2 | — |
| AVEVA | Batch Management | ≤ 2020 SP1 | — |
| AVEVA | Edge (formerly known as Indusoft Web Studio) | ≤ 2020 R2 SP1 P01 | — |
| AVEVA | Worktasks (formerly known as Workflow Management) | ≤ 2020 U2 | — |
| AVEVA | Plant SCADA (formerly known as Citect) | ≤ 2020 R2 Update 15 | — |
| AVEVA | Mobile Operator (formerly known as IntelaTrac Mobile Operator Rounds) | ≤ 2020 R1 | — |
| AVEVA | Communication Drivers Pack | ≤ 2020 R2 SP1 | — |
| AVEVA | Telemetry Server | ≤ 2020 R2 SP1 | — |
Advisories 1
- ICSA-23-318-01 AVEVA Operations Control Logger CISA ICS & IT advisories · Nov 14, 2023