Vulnerability in Osisoft Pi API
CVE-2020-10606
In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. This exploitation can result in unauthorized information disclosure, deletion, or modification if the local computer also processes PI System data from other users, such as from a shared workstation or terminal server deployment.
EPSS: 0.003 (18.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Osisoft Pi_api
- Osisoft Pi_buffer_subsystem
- Osisoft Pi_connector
- Osisoft Pi_connector_relay
- Osisoft Pi_data_archive
- Osisoft Pi_data_collection_manager
- Osisoft Pi_integrator
- Osisoft Pi_interface_configuration_utility
- Osisoft Pi_to_ocs
- N/a Osisoft Pi System Multiple Products And Versions — versions OSIsoft PI System multiple products and versions
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-10606?
- CVE-2020-10606 is a high-severity vulnerability in Osisoft Pi API, classified under Incorrect Default Permissions. CVSS score: 7.8/10. Published 2020-07-24.
- How severe is CVE-2020-10606?
- High severity. CVSS v3 base score is 7.8 out of 10.