CVE-2020-10604

In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requests. This can result in blocking connections and queries to PI Data Archive.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:osisoft:pi_data_archive:2018:::::::*
	cpe:2.3:a:osisoft:pi_data_archive:2018:sp2::::::

History

No history.

Information

Published : 2020-07-25 00:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-10604

Mitre link : CVE-2020-10604

CVE.ORG link : CVE-2020-10604

JSON object : View

Products Affected

osisoft

pi_data_archive

CWE

CWE-755

Improper Handling of Exceptional Conditions

CWE-248

Uncaught Exception

{"id": "CVE-2020-10604", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-07-25T00:15:12.047", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-755"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-248"}]}], "descriptions": [{"lang": "en", "value": "In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requests. This can result in blocking connections and queries to PI Data Archive."}, {"lang": "es", "value": "En m\u00faltiples productos y versiones de OSIsoft PI System, un atacante no autenticado remoto podr\u00eda bloquear el servicio PI Network Manager por medio de peticiones especialmente dise\u00f1adas. Esto puede resultar en un bloqueo de conexiones y consultas hacia PI Data Archive"}], "lastModified": "2022-10-21T17:16:47.677", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:osisoft:pi_data_archive:2018:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63C6A570-022D-4C08-9FDD-D08D20CC8D28"}, {"criteria": "cpe:2.3:a:osisoft:pi_data_archive:2018:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84660314-99C6-4E93-83F5-068EDFD0D189"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}