Execution with unnecessary privileges in AVEVA Software, LLC. products - CVE-2023-33873

Vulnerability identifier: #VU83208

CSH Severity: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2023-33873

CWE-ID: CWE-250

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
AVEVA SystemPlatform
AVEVA Application Server
AVEVA Enterprise Licensing
AVEVA Recipe Management
AVEVA Worktasks
AVEVA Plant SCADA
AVEVA Telemetry Server
AVEVA Operations Control Logger
AVEVA Historian
AVEVA InTouch
AVEVA Manufacturing Execution System
AVEVA Batch Management
AVEVA Mobile Operator
AVEVA Communication Drivers Pack
AVEVA Edge

Software vendor:
AVEVA Software, LLC.

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application binary has a setuid bit. A local low-privileged user can run the affected binary and execute arbitrary code on the system with root privileges.

Install updates from vendor's website.

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01
• https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AV...