What is CVE-2023-1256?

CVE-2023-1256 is a critical-severity vulnerability in Aveva Plant Scada, classified under CWE-285 IMPROPER AUTHORIZATION. CVSS score: 9.8/10. Published 2023-03-16.

How severe is CVE-2023-1256?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Aveva Plant Scada

CVE-2023-1256

The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.

EPSS: 0.007 (48.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Aveva Plant Scada — versions 2023 Update 10, 2020R2 Update 10
Aveva Aveva_plant_scada — versions 2020r2, 2023
Aveva Telemetry Server — versions 2020 R2 SP1
Aveva Telemetry_server — versions 2020r2

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory)

Frequently asked questions

What is CVE-2023-1256?: CVE-2023-1256 is a critical-severity vulnerability in Aveva Plant Scada, classified under CWE-285 IMPROPER AUTHORIZATION. CVSS score: 9.8/10. Published 2023-03-16.
How severe is CVE-2023-1256?: Critical severity. CVSS v3 base score is 9.8 out of 10.