High severity · published Aug 25, 2017
CVE-2017-7930
An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017
7.4
CVSS
2%
EPSS
No
On KEV
Description
An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Data Archive has protocol flaws with the potential to expose change records in the clear and allow a malicious party to spoof a server within a collective.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PD
PI Data Archive · Osisoft
through 3.4.410.1256 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7930
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7930
Third Party Advisory
http://www.securityfocus.com/bid/99059
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-164-02
More from PI Data Archive
7.8
CVE-2020-10610
In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the…
7.8
CVE-2020-10608
In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries
7.8
CVE-2020-10606
In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software
7.8
CVE-2018-7533
An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior
7.5
CVE-2020-10604
In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requests