PT-2023-2372 · Aveva · Aveva Plant Scada+1

Published 2023-03-14 · Updated 2023-03-22 · CVE-2023-1256

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AVEVA Plant SCADA (affected versions not specified) AVEVA Telemetry Server (affected versions not specified)

Description The issue is related to an improper authorization exploit. This could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states. The vulnerability is caused by weaknesses in the authorization procedure, which can be exploited by a remote, unauthenticated attacker to cause a denial of service.

Recommendations For AVEVA Plant SCADA, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For AVEVA Telemetry Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2023-02147

CVE-2023-1256

Affected Products

Aveva Plant Scada

Aveva Telemetry Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-1256 · Security Note
• https://bdu.fstec.ru/vul/2023-02147 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1256 · Vendor Advisory
• https://cisa.gov/news-events/ics-advisories/icsa-23-073-04 · Note
• https://t.me/cibsecurity/60176 · Telegram Post