CVE-2023-33873
highPriorität · verfolgen · 31EPSS 0.002 · 14. PerzentilEUUSEPSS · bewertet 2026-10-21
This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationAVEVA Application Servercisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Batch Managementcisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Communication Drivers Packcisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Edge (formerly known as Indusoft Web Studio)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Enterprise Licensing (formerly known as License Manager)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Historiancisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA InTouchcisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Manufacturing Execution System (formerly known as Wonderware MES)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Mobile Operator (formerly known as IntelaTrac Mobile Operator Rounds)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Plant SCADA (formerly known as Citect)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Recipe Managementcisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA SystemPlatformcisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Telemetry Servercisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Worktasks (formerly known as Workflow Management)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (65)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-23-318-01AVEVA Operations Control Logger2023-11-14icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow privilege escalation or denial of service.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2023-33873/cnnvd
- https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2023-003.pdfPatchcnnvd
- https://www.aveva.com/en/support-and-success/cyber-security-updates/cnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01cnnvd
- https://www.aveva.com/en/support-and-success/cyber-security-updates/enisa_euvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01enisa_euvd
- https://www.aveva.com/en/support-and-success/cyber-security-updates/Vendor Advisorynvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01Third Party AdvisoryUS Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan