CVE-2020-10610
EUVD-2020-305824.07.2020, 23:15
In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| osisoft | pi_api | 𝑥 ≤ 1.6.8.26 |
| osisoft | pi_api | 𝑥 ≤ 2.0.2.5 |
| osisoft | pi_buffer_subsystem | 𝑥 ≤ 4.8.0.18 |
| osisoft | pi_connector | 𝑥 ≤ 1.0.0.54 |
| osisoft | pi_connector | 𝑥 ≤ 1.1.0.10 |
| osisoft | pi_connector | 𝑥 ≤ 1.2.0.6 |
| osisoft | pi_connector | 𝑥 ≤ 1.2.0.42 |
| osisoft | pi_connector | 𝑥 ≤ 1.2.1.71 |
| osisoft | pi_connector | 𝑥 ≤ 1.2.2.79 |
| osisoft | pi_connector | 𝑥 ≤ 1.3.0.1 |
| osisoft | pi_connector | 𝑥 ≤ 1.3.0.130 |
| osisoft | pi_connector | 𝑥 ≤ 1.3.1.135 |
| osisoft | pi_connector | 𝑥 ≤ 1.4.0.17 |
| osisoft | pi_connector | 𝑥 ≤ 1.5.0.88 |
| osisoft | pi_connector_relay | 𝑥 ≤ 2.5.19.0 |
| osisoft | pi_data_archive | 𝑥 ≤ 3.4.430.460 |
| osisoft | pi_data_collection_manager | 𝑥 ≤ 2.5.19.0 |
| osisoft | pi_integrator | 𝑥 ≤ 2.2.0.183 |
| osisoft | pi_interface_configuration_utility | 𝑥 ≤ 1.5.0.7 |
| osisoft | pi_to_ocs | 𝑥 ≤ 1.1.36.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-427 - Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
- CWE-426 - Untrusted Search PathThe application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.