PT-2022-10171 · Aveva · Aveva System Platform

Sharon Brizinov · Published 2022-04-04 · Updated 2022-04-13 · CVE-2021-32977

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVEVA System Platform versions 2017 through 2020 R2 P01

Description The issue is related to the verification of cryptographic signatures for data. Specifically, the software does not verify, or incorrectly verifies, these signatures.

Recommendations For AVEVA System Platform versions 2017 through 2020 R2 P01, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2021-32977

Affected Products

Aveva System Platform

References · 5

• https://aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32977 · Security Note
• https://t.me/cvenotify/28824 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-180-05 · Note