Vulnerability in Aveva Plant Scada
CVE-2023-1256
The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (50.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 50.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Aveva Plant Scada — versions 2023 Update 10, 2020R2 Update 10
- Aveva Plant Scada — versions 2020r2, 2023
- Aveva Telemetry Server — versions 2020 R2 SP1
- Aveva Telemetry Server — versions 2020r2
References
- www.cisa.gov/news-events/ics-advisories/icsa-23-073-04 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-1256?
- CVE-2023-1256 is a critical-severity vulnerability in Aveva Plant Scada, classified under CWE-285 IMPROPER AUTHORIZATION. CVSS score: 9.8/10. Published 2023-03-16.
- How severe is CVE-2023-1256?
- Critical severity. CVSS v3 base score is 9.8 out of 10.