7.8

CVE-2020-10608

In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. This exploitation can target another local user of PI System software on the computer to escalate privilege and result in unauthorized information disclosure, deletion, or modification.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Osisoft ≫ Pi Api Version <= 1.6.8.26
Osisoft ≫ Pi Api SwPlatform windows_integrated_security Version <= 2.0.2.5
Osisoft ≫ Pi Buffer Subsystem Version <= 4.8.0.18
Osisoft ≫ Pi Connector SwPlatform ping Version <= 1.0.0.54
Osisoft ≫ Pi Connector SwPlatform ethernet/ip Version <= 1.1.0.10
Osisoft ≫ Pi Connector SwPlatform bacnet Version <= 1.2.0.6
Osisoft ≫ Pi Connector SwPlatform dc_systems_rtscada Version <= 1.2.0.42
Osisoft ≫ Pi Connector SwPlatform siemens_simatic_pcs_7 Version <= 1.2.1.71
Osisoft ≫ Pi Connector SwPlatform iec_60870-5-104 Version <= 1.2.2.79
Osisoft ≫ Pi Connector SwPlatform hart-ip Version <= 1.3.0.1
Osisoft ≫ Pi Connector SwPlatform opc-ua Version <= 1.3.0.130
Osisoft ≫ Pi Connector SwPlatform ufl Version <= 1.3.1.135
Osisoft ≫ Pi Connector SwPlatform cygnet Version <= 1.4.0.17
Osisoft ≫ Pi Connector SwPlatform wonderware_historian Version <= 1.5.0.88
Osisoft ≫ Pi Connector Relay Version <= 2.5.19.0
Osisoft ≫ Pi Data Archive Version <= 3.4.430.460
Osisoft ≫ Pi Data Collection Manager Version <= 2.5.19.0
Osisoft ≫ Pi Integrator SwPlatform business_analytics Version <= 2.2.0.183
Osisoft ≫ Pi To Ocs Version <= 1.1.36.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.126
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02
Third Party Advisory
US Government Resource