CVE-2023-33873
highpriority · track · 31EPSS 0.002 · 14 %ileEUUSEPSS · scored 2026-10-21
This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationAVEVA Application Servercisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Batch Managementcisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Communication Drivers Packcisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Edge (formerly known as Indusoft Web Studio)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Enterprise Licensing (formerly known as License Manager)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Historiancisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA InTouchcisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Manufacturing Execution System (formerly known as Wonderware MES)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Mobile Operator (formerly known as IntelaTrac Mobile Operator Rounds)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Plant SCADA (formerly known as Citect)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Recipe Managementcisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA SystemPlatformcisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Telemetry Servercisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
- MitigationAVEVA Worktasks (formerly known as Workflow Management)cisa_csaf_ot
Ensure that Guest or Anonymous local OS accounts are disabled.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (65)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-23-318-01AVEVA Operations Control Logger2023-11-14icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow privilege escalation or denial of service.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-33873/cnnvd
- https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2023-003.pdfPatchcnnvd
- https://www.aveva.com/en/support-and-success/cyber-security-updates/cnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01cnnvd
- https://www.aveva.com/en/support-and-success/cyber-security-updates/enisa_euvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01enisa_euvd
- https://www.aveva.com/en/support-and-success/cyber-security-updates/Vendor Advisorynvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01Third Party AdvisoryUS Government Resourcenvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan