CVE-2023-34982: AVEVA Operations Control Logger External Control of File Name or Path

DescriptionCVE.org

This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service.

• AVEVA · SystemPlatformup to and including 2020 R2 SP1 P01
• AVEVA · Historianup to and including 2020 R2 SP1 P01
• AVEVA · Application Serverup to and including 2020 R2 SP1 P01
• AVEVA · InTouchup to and including 2020 R2 SP1 P01
• AVEVA · Enterprise Licensing (formerly known as License Manager)up to and including 3.7.002
• AVEVA · Manufacturing Execution System (formerly known as Wonderware MES)up to and including 2020 P01
• AVEVA · Recipe Managementup to and including 2020 R2 Update 1 Patch 2
• AVEVA · Batch Managementup to and including 2020 SP1
• AVEVA · Edge (formerly known as Indusoft Web Studio)up to and including 2020 R2 SP1 P01
• AVEVA · Worktasks (formerly known as Workflow Management)up to and including 2020 U2
• AVEVA · Plant SCADA (formerly known as Citect)up to and including 2020 R2 Update 15
• AVEVA · Mobile Operator (formerly known as IntelaTrac Mobile Operator Rounds)up to and including 2020 R1
• AVEVA · Communication Drivers Packup to and including 2020 R2 SP1
• AVEVA · Telemetry Serverup to and including 2020 R2 SP1

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

External Control of File Name or Path · File and Path Handling

Vendor

AVEVA

Published

November 2023

Band

Unlikely (under 1%), November 2023

• NVD entrynvd.nist.gov
• CVE recordcve.org
• Weakness CWE-73cwe.mitre.org
• cisa.gov/news-events/ics-advisories/icsa-23-318-01cisa.gov
• aveva.com/en/support-and-success/cyber-security-updatesaveva.com