PT-2023-24526 · Aveva · Application Server+14

Lukasz Piotrowski · Published 2023-11-15 · Updated 2023-12-08 · CVE-2023-33873

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description This issue allows a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where the products are installed, resulting in complete compromise of the target machine.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2023-33873

Affected Products

Application Server

Batch Management

Communication Drivers Pack

Edge

Enterprise Licensing

Historian

Intouch

Manufacturing Execution System

Mobile Operator

Plant Scada

Recipe Management

System Platform

Telemetry Server

Worktasks

Communication Drivers

References · 5

• https://osv.dev/vulnerability/CVE-2023-33873 · Vendor Advisory
• https://aveva.com/en/support-and-success/cyber-security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33873 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-318-01 · Note
• https://t.me/cvenotify/62968 · Telegram Post