Insecure DLL loading in AVEVA Software, LLC. products - CVE-2021-38410

Vulnerability identifier: #VU56440

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-38410

CWE-ID: CWE-427

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner. A local user can control one or more locations in the search path.

Platform Common Services (PCS) Portal
AVEVA Batch Management
AVEVA Mobile Operator
AVEVA Manufacturing Execution System
AVEVA Work Tasks
AVEVA Enterprise Data Management
AVEVA System Platform

Install updates from vendor's website.

Platform Common Services (PCS) Portal - addressed in versions 4.4.7, 4.5.3

• https://ics-cert.us-cert.gov/advisories/icsa-21-252-01
• https://www.aveva.com/en/support-and-success/cyber-security-updates/

• Insecure DLL loading in AVEVA PCS Portal