AVEVA System Platform Origin Validation Error
Priority LOW 34CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.
Summary
AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00501 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AVEVA | AVEVA System Platform | 2017 – 2020 R2 P01 | — | No fix listed | CNA |
- AVEVA System Platform VendorAVEVA Affected 2017 – 2020 R2 P01 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:aveva:system_platform:*:*:*:*:*:*:*:* | 2017 to before 2020 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:system_platform:2020:-:*:*:*:*:*:* | 2020 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:system_platform:2020:r2:*:*:*:*:*:* | 2020 r2 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:system_platform:2020:r2_p01:*:*:*:*:*:* | 2020 r2_p01 | Vulnerable | AVEVA |
- cpe:2.3:a:aveva:system_platform:*:*:*:*:*:*:*:* Versions 2017 to before 2020 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:system_platform:2020:-:*:*:*:*:*:* Versions 2020 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:system_platform:2020:r2:*:*:*:*:*:* Versions 2020 r2 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:system_platform:2020:r2_p01:*:*:*:*:*:* Versions 2020 r2_p01 Vulnerable ·AVEVA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32985
- 2026-10-03 Alias added: GHSA-w992-vgrp-856g
References
More AVEVA System Platform vulnerabilities
- TI-2021-12615 AVEVA System Platform Missing Authentication for Critical Function CVSS 3.1CRITICAL 9.8
- TI-2021-12617 AVEVA System Platform Uncaught Exception CVSS 3.1HIGH 7.5
- TI-2023-16745 AVEVA Operations Control Logger Execution with Unnecessary Privileges CVSS 3.1HIGH 7.8
- TI-2022-00742 AVEVA System Platform Cleartext Storage of Sensitive Information in Memory CVSS 3.1HIGH 8.1
- TI-2021-12589 AVEVA System Platform Path Traversal CVSS 3.1HIGH 7.2
- TI-2021-16014 AVEVA PCS Portal Uncontrolled Search Path Element CVSS 3.1HIGH 7.8
Sources
- CVE-2021-32985 · CVE Program
- CVE-2021-32985 · NVD
- FIRST EPSS
- GHSA-w992-vgrp-856g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences