High severity · published Jul 24, 2020
CVE-2020-10610
In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
PI Api · Osisoft
through 1.6.8.26; through 2.0.2.5 · source: NVD
PB
PI Buffer Subsystem · Osisoft
through 4.8.0.18 · source: NVD
PC
PI Connector · Osisoft
through 1.0.0.54; through 1.1.0.10; through 1.2.0.6; through 1.2.0.42; through 1.2.1.71; through 1.2.2.79; +5 more · source: NVD
PC
PI Connector Relay · Osisoft
through 2.5.19.0 · source: NVD
PD
PI Data Archive · Osisoft
through 3.4.430.460 · source: NVD
PD
PI Data Collection Manager · Osisoft
through 2.5.19.0 · source: NVD
PI
PI Integrator · Osisoft
through 2.2.0.183 · source: NVD
PI
PI Interface Configuration Utility · Osisoft
through 1.5.0.7 · source: NVD
PT
PI TO Ocs · Osisoft
through 1.1.36.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10610
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10610
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02
More from PI Api
7.8
CVE-2020-10608
In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries
7.8
CVE-2020-10606
In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software