CVE-2021-32979
Assigner: icscert
Published: 2021-08-19T00:00:00
State: PUBLISHED
affected: product: AVEVA System Platform 2020
vendor: AVEVA Software, LLC
versions: lessThanOrEqual: R2 P01
status: affected
version: unspecified
versionType: custom
product: AVEVA InTouch 2020
vendor: AVEVA Software, LLC
versions: lessThanOrEqual: R2 P01
status: affected
version: unspecified
versionType: custom
product: AVEVA Historian 2020 
vendor: AVEVA Software, LLC
versions: lessThanOrEqual: R2 P01
status: affected
version: unspecified
versionType: custom
product: AVEVA Communication Drivers Pack 2020 
vendor: AVEVA Software, LLC
versions: lessThanOrEqual: R2
status: affected
version: unspecified
versionType: custom
product: AVEVA Batch Management 2020
vendor: AVEVA Software, LLC
versions: lessThanOrEqual: 2020
status: affected
version: unspecified
versionType: custom
product: AVEVA MES 2014
vendor: AVEVA Software, LLC
versions: lessThanOrEqual: R2
status: affected
version: unspecified
versionType: custom
credits: value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA
datePublic: 2021-08-19T00:00:00
descriptions: value: Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-476
description: CWE-476 NULL Pointer Dereference
type: CWE
solutions: value: AVEVA recommends organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.

Users with affected versions of these products should apply the corresponding security update. Note a subset of the updates requires activation-based licensing.

Please see AVEVA security bulletin AVEVA-2021-003 for more information.
source: advisory: ICSA-21-231-01
discovery: UNKNOWN
title: AVEVA SuiteLink Server Null Pointer Dereference
x_generator: engine: Vulnogram 0.0.9