CVE-2020-10610

{"id": "CVE-2020-10610", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-07-24T23:15:11.940", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-426"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification."}, {"lang": "es", "value": "En m\u00faltiples productos y versiones de OSIsoft PI System, un atacante local puede modificar una ruta de b\u00fasqueda y plantar un binario para explotar el software de PI System afectado para tomar el control de la computadora local en el nivel de privilegio system de Windows, resultando en una divulgaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n de informaci\u00f3n no autorizada"}], "lastModified": "2021-12-21T12:46:15.087", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:osisoft:pi_api:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D7B554C-447F-4C1B-838F-A6E8F690F6A6", "versionEndIncluding": "1.6.8.26"}, {"criteria": "cpe:2.3:a:osisoft:pi_api:*:*:*:*:*:windows_integrated_security:*:*", "vulnerable": true, "matchCriteriaId": "EDCD07A7-9079-444E-8AF0-EDD2CE8CEED4", "versionEndIncluding": "2.0.2.5"}, {"criteria": "cpe:2.3:a:osisoft:pi_buffer_subsystem:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A895F35-CC2E-4B74-99E7-5801C4276336", "versionEndIncluding": "4.8.0.18"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector:*:*:*:*:*:ping:*:*", "vulnerable": true, "matchCriteriaId": "19394A8B-C47C-4A1C-8D73-B2FAE624B504", "versionEndIncluding": "1.0.0.54"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector:*:*:*:*:*:ethernet\\/ip:*:*", "vulnerable": true, "matchCriteriaId": "E0889A10-FEFA-422A-81C6-33595076D5B9", "versionEndIncluding": "1.1.0.10"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector:*:*:*:*:*:bacnet:*:*", "vulnerable": true, "matchCriteriaId": "F024275D-CC0D-40A6-8618-B8C2BCAC3453", "versionEndIncluding": "1.2.0.6"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector:*:*:*:*:*:dc_systems_rtscada:*:*", "vulnerable": true, "matchCriteriaId": "1634EED8-EE12-4F24-9D79-2108906D5941", "versionEndIncluding": "1.2.0.42"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector:*:*:*:*:*:siemens_simatic_pcs_7:*:*", "vulnerable": true, "matchCriteriaId": "3E4CA46D-C31A-4052-B3F1-755DC273D662", "versionEndIncluding": "1.2.1.71"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector:*:*:*:*:*:iec_60870-5-104:*:*", "vulnerable": true, "matchCriteriaId": "24376704-9C47-4BE7-AB95-1E5E194AD5A9", "versionEndIncluding": "1.2.2.79"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector:*:*:*:*:*:hart-ip:*:*", "vulnerable": true, "matchCriteriaId": "DB0A663F-3C53-43CF-AE8B-C2FD93AE0547", "versionEndIncluding": "1.3.0.1"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector:*:*:*:*:*:opc-ua:*:*", "vulnerable": true, "matchCriteriaId": "DC780244-6475-4051-A901-02CF37CD80DC", "versionEndIncluding": "1.3.0.130"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector:*:*:*:*:*:ufl:*:*", "vulnerable": true, "matchCriteriaId": "9912030A-5A3C-4254-B440-D3D8C47432A9", "versionEndIncluding": "1.3.1.135"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector:*:*:*:*:*:cygnet:*:*", "vulnerable": true, "matchCriteriaId": "56274097-C75B-48BB-AA8A-C1213BCD1F37", "versionEndIncluding": "1.4.0.17"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector:*:*:*:*:*:wonderware_historian:*:*", "vulnerable": true, "matchCriteriaId": "EEB864E3-549D-4B2D-B89F-74E2F2454BEC", "versionEndIncluding": "1.5.0.88"}, {"criteria": "cpe:2.3:a:osisoft:pi_connector_relay:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "474D5BE5-759E-4760-A4CC-661019379A47", "versionEndIncluding": "2.5.19.0"}, {"criteria": "cpe:2.3:a:osisoft:pi_data_archive:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A918A5B9-40B4-4B00-A9F3-5F2F551447B5", "versionEndIncluding": "3.4.430.460"}, {"criteria": "cpe:2.3:a:osisoft:pi_data_collection_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C99F2BBE-D5E7-4F6F-B03F-1250F9D31542", "versionEndIncluding": "2.5.19.0"}, {"criteria": "cpe:2.3:a:osisoft:pi_integrator:*:*:*:*:*:business_analytics:*:*", "vulnerable": true, "matchCriteriaId": "31D2D676-90D7-4516-BCDB-86DE0F34B43B", "versionEndIncluding": "2.2.0.183"}, {"criteria": "cpe:2.3:a:osisoft:pi_interface_configuration_utility:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23B33817-C61B-4369-A5B0-A9CAA6E83C62", "versionEndIncluding": "1.5.0.7"}, {"criteria": "cpe:2.3:a:osisoft:pi_to_ocs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0D626AC-1990-4885-AEEB-8E897D6A9FF9", "versionEndIncluding": "1.1.36.0"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}