Improper Handling of Exceptional Conditions in AVEVA Software, LLC. products - CVE-2021-32999

Vulnerability identifier: #VU56003

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-32999

CWE-ID: CWE-755

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper handling of exceptional conditions in SuiteLink server while processing command 0x01. A remote attacker can cause a denial of service condition on the target system.

AVEVA System Platform
AVEVA InTouch
AVEVA Historian
AVEVA Communication Drivers Pack
AVEVA Operations Integration Core
AVEVA Data Acquisition Servers
AVEVA Batch Management
AVEVA MES
AVEVA SuiteLink Server

Install updates from vendor's website.

AVEVA Communication Drivers Pack - update to 2020 R2.1
AVEVA MES - update to 2014 R3
AVEVA SuiteLink Server - update to 3.2.002

• https://ics-cert.us-cert.gov/advisories/icsa-21-231-01
• https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AV...

• Multiple vulnerabilities in AVEVA SuiteLink Server