by Kastro
Paper/Archive/CVE-2021-33008

CVE-2021-33008

AVEVA AVEVA System Platform — AVEVA System Platform Missing Authentication for Critical Function

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 67.0.670 × 2013.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

AVEVA System Platform versions 2017 through 2020 R2 P01 does not perform any authentication for functionality that requires a provable user identity.

Affected

ProductAffectedFixed inSource
AVEVA System Platform2017 – 2020 R2 P01–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-21-180-05refaveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf