CVEvulnerability
CVE-2023-33873
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-11-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-250
Description
This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.
Affected configurations
• aveva batch management (< 2020)
• aveva batch management 2020
• aveva communication drivers (< 2020)
• aveva communication drivers 2020
• aveva edge (<= 20.1.101)
• aveva enterprise licensing (<= 3.7.002)
• aveva historian (< 2020)
• aveva historian 2020
• aveva intouch (< 2020)
• aveva intouch 2020
• aveva manufacturing execution system (< 2020)
• aveva manufacturing execution system 2020
• aveva mobile operator (< 2020)
• aveva mobile operator 2020
• aveva plant scada (< 2020)
• aveva plant scada 2020
• aveva recipe management (< 2020)
• aveva recipe management 2020
• aveva system platform (< 2020)
• aveva system platform 2020
• aveva telemetry server 2020r2
• aveva work tasks (< 2020)
• aveva work tasks 2020
Related
Weakness · CWE (1)
- CWE-250 Execution with Unnecessary Privileges weakness
References
- https://www.aveva.com/en/support-and-success/cyber-security-updates/ Vendor Advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01 Third Party Advisory, US Government Resource
- https://www.aveva.com/en/support-and-success/cyber-security-updates/ Vendor Advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01 Third Party Advisory, US Government Resource