CVE-2020-10606

Public PoC / Exploit

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. This exploitation can result in unauthorized information disclosure, deletion, or modification if the local computer also processes PI System data from other users, such as from a shared workstation or terminal server deployment.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-276CWE-276

Affected Products (20)

osisoft · pi_apivulnerable

osisoft · pi_buffer_subsystemvulnerable

osisoft · pi_connectorvulnerable

osisoft · pi_connector_relayvulnerable

osisoft · pi_data_archivevulnerable

osisoft · pi_data_collection_managervulnerable

osisoft · pi_integratorvulnerable

osisoft · pi_interface_configuration_utilityvulnerable

osisoft · pi_to_ocsvulnerable

References (2)

https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02

Third Party AdvisoryUS Government Resource

https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02

Third Party AdvisoryUS Government Resource