OSIsoft PI Asset Framework Client default permission

Summaryinfo

A vulnerability was found in OSIsoft PI Asset Framework Client, PI Software Development Kit, PI API, PI Buffer Subsystem, PI Connector, PI Data Archive, PI Data Collection Manager, PI Integrator for Business Analytics, PI Interface Configuration Utility and PI to OCS. It has been rated as critical. This affects an unknown function. Performing a manipulation results in default permission. This vulnerability is identified as CVE-2020-10606. The attack is only possible with local access. There is not any exploit available.

Detailsinfo

A vulnerability was found in OSIsoft PI Asset Framework Client, PI Software Development Kit, PI API, PI Buffer Subsystem, PI Connector, PI Data Archive, PI Data Collection Manager, PI Integrator for Business Analytics, PI Interface Configuration Utility and PI to OCS (Automation Software). It has been classified as critical. This affects an unknown function. The manipulation with an unknown input leads to a default permission vulnerability. CWE is classifying the issue as CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. This exploitation can result in unauthorized information disclosure, deletion, or modification if the local computer also processes PI System data from other users, such as from a shared workstation or terminal server deployment.

The weakness was released 07/24/2020 (Website). It is possible to read the advisory at us-cert.cisa.gov. This vulnerability is uniquely identified as CVE-2020-10606 since 03/16/2020. Attacking locally is a requirement. The successful exploitation requires a authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-158988, VDB-158989, VDB-158990 and VDB-158992. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• OSIsoft

Name

• PI API
• PI Asset Framework Client
• PI Buffer Subsystem
• PI Connector
• PI Data Archive
• PI Data Collection Manager
• PI Integrator for Business Analytics
• PI Interface Configuration Utility
• PI Software Development Kit
• PI to OCS

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion