CVE-2020-10643: OSIsoft PI System

Published Jul 27, 2020

Updated

An authenticated remote attacker could use specially crafted URLs to send a victim using PI Vision 2019 mobile to a vulnerable web page due to a known issue in a third-party component.

Affected Software

19 affected components

OSIsoft Applications using PI Asset Framework (AF) Client versions prior to and including PI AF Client 2018 SP3 Patch 1, Version 2.10.7.283

OSIsoft Applications using PI Software Development Kit (SDK) versions prior to and including PI SDK 2018 SP1, Version 1.4.7.602

OSIsoft PI API for Windows Integrated Security versions prior to and including 2.0.2.5,

OSIsoft PI API versions prior to and including 1.6.8.26

OSIsoft PI Buffer Subsystem versions prior to and including 4.8.0.18

OSIsoft PI Connector for BACnet, versions prior to and including 1.2.0.6

OSIsoft PI Connector for CygNet, versions prior to and including 1.4.0.17

OSIsoft PI Connector for DC Systems RTscada, versions prior to and including 1.2.0.42

OSIsoft PI Connector for Ethernet/IP, versions prior to and including 1.1.0.10

OSIsoft PI Connector for HART-IP, versions prior to and including 1.3.0.1

OSIsoft PI Connector for Ping, versions prior to and including 1.0.0.54

OSIsoft PI Connector for Wonderware Historian, versions prior to and including 1.5.0.88

OSIsoft PI Connector Relay, versions prior to and including 2.5.19.0

OSIsoft PI Data Archive versions prior to and including PI Data Archive 2018 SP3, Version 3.4.430.460

OSIsoft PI Data Collection Manager, versions prior to and including 2.5.19.0

OSIsoft PI Integrator for Business Analytics versions prior to and including 2018 R2 SP1, Version 2.2.0.183

OSIsoft PI Interface Configuration Utility (ICU) versions prior to and including 1.5.0.7

OSIsoft PI to OCS versions prior to and including 1.1.36.0

OSIsoft PI Vision=2019

Remediation

Information

Limit write access to PI Vision displays to trusted users.

Event History

Jul 27, 2020

CVE Published

via MITRE·09:20 PM

Data Sourced

via MITRE·09:20 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-20-133-02

Frequently Asked Questions

What is CVE-2020-10643?

CVE-2020-10643 is a vulnerability that allows an authenticated remote attacker to send specially crafted URLs to victims using PI Vision 2019 mobile and lead them to a vulnerable web page.

How does CVE-2020-10643 affect PI Vision 2019?

CVE-2020-10643 affects PI Vision 2019 by exploiting a known issue in a third-party component, allowing an authenticated remote attacker to use specially crafted URLs.

What is the severity of CVE-2020-10643?

CVE-2020-10643 has a severity score of 5.4, which is considered medium.

How can I fix CVE-2020-10643?

To fix CVE-2020-10643, it is recommended to apply the necessary security updates or patches provided by OSIsoft.

Where can I find more information about CVE-2020-10643?

You can find more information about CVE-2020-10643 on the official website of the United States Computer Emergency Readiness Team (US-CERT).