OTPulse
FeedAboutContact

AVEVA Plant SCADA and AVEVA Telemetry Server

Act Now9.8ICS-CERT ICSA-23-073-04Mar 29, 2023
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in AVEVA Plant SCADA and Telemetry Server allows unauthenticated users to read process data, cause denial of service, and modify alarm states. The vulnerability stems from improper authorization controls (CWE-285). Successful exploitation requires only network reachability to the affected service ports.

What this means
What could happen
An attacker could read sensitive process data, disable alarms, and disrupt plant operations without needing credentials. This impacts visibility and control over critical processes.
Who's at risk
Energy sector operators using AVEVA Plant SCADA (2020R2 or 2023) and AVEVA Telemetry Server (2020 R2) should prioritize patching. These systems monitor and control critical plant operations including generation, distribution, and process automation.
How it could be exploited
An attacker with network access to the Plant SCADA or Telemetry Server service ports can send unauthenticated requests to exploit an improper authorization vulnerability, allowing them to read data, trigger denial of service, or modify alarm states.
Prerequisites
  • Network access to Plant SCADA or Telemetry Server service ports
  • No credentials required
remotely exploitableno authentication requiredlow complexityhigh CVSS score (9.8)
Exploitability
Low exploit probability (EPSS 0.2%)
Affected products (2)
1 with fix1 pending
ProductAffected VersionsFix Status
Plant SCADA 2023, AVEVA Plant SCADA 2020R2: Update 10 and all prior versions≤ 10Update 11 or later
Telemetry Server 2020 R2: SP1 and all prior versions≤ SP1No fix yet
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDRestrict network access to Plant SCADA and Telemetry Server ports using firewall rules; limit access to authorized engineering workstations and control systems only
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

HOTFIXUpgrade AVEVA Plant SCADA 2023 to Update 1 or later
HOTFIXUpgrade AVEVA Plant SCADA 2020R2 to Update 11 or later
HOTFIXUpgrade AVEVA Telemetry Server 2020 R2 to SP2 or later
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/9d53916e-cde2-40fb-b788-83c14a116f10