CVE-2020-10610
24.07.2020, 23:15
In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification.Enginsight
| Vendor | Product | Version |
|---|---|---|
| osisoft | pi_api | 𝑥 ≤ 1.6.8.26 |
| osisoft | pi_api | 𝑥 ≤ 2.0.2.5 |
| osisoft | pi_buffer_subsystem | 𝑥 ≤ 4.8.0.18 |
| osisoft | pi_connector | 𝑥 ≤ 1.0.0.54 |
| osisoft | pi_connector | 𝑥 ≤ 1.1.0.10 |
| osisoft | pi_connector | 𝑥 ≤ 1.2.0.6 |
| osisoft | pi_connector | 𝑥 ≤ 1.2.0.42 |
| osisoft | pi_connector | 𝑥 ≤ 1.2.1.71 |
| osisoft | pi_connector | 𝑥 ≤ 1.2.2.79 |
| osisoft | pi_connector | 𝑥 ≤ 1.3.0.1 |
| osisoft | pi_connector | 𝑥 ≤ 1.3.0.130 |
| osisoft | pi_connector | 𝑥 ≤ 1.3.1.135 |
| osisoft | pi_connector | 𝑥 ≤ 1.4.0.17 |
| osisoft | pi_connector | 𝑥 ≤ 1.5.0.88 |
| osisoft | pi_connector_relay | 𝑥 ≤ 2.5.19.0 |
| osisoft | pi_data_archive | 𝑥 ≤ 3.4.430.460 |
| osisoft | pi_data_collection_manager | 𝑥 ≤ 2.5.19.0 |
| osisoft | pi_integrator | 𝑥 ≤ 2.2.0.183 |
| osisoft | pi_interface_configuration_utility | 𝑥 ≤ 1.5.0.7 |
| osisoft | pi_to_ocs | 𝑥 ≤ 1.1.36.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-427 - Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
- CWE-426 - Untrusted Search PathThe application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.