The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an…
Priority MEDIUM 50Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00678 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AVEVA | AVEVA Plant SCADA | 2023 Update 10 | — | No fix listed | CNA |
| AVEVA | AVEVA Plant SCADA | 2020R2 Update 10 | — | No fix listed | CNA |
| AVEVA | AVEVA Telemetry Server | 2020 R2 SP1 | — | No fix listed | CNA |
- AVEVA Plant SCADA VendorAVEVA Affected 2023 Update 10 Fixed in — No fix listed CNA
- AVEVA Plant SCADA VendorAVEVA Affected 2020R2 Update 10 Fixed in — No fix listed CNA
- AVEVA Telemetry Server VendorAVEVA Affected 2020 R2 SP1 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:aveva:aveva_plant_scada:2020r2:-:*:*:*:*:*:* | 2020r2 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:aveva_plant_scada:2020r2:update_10:*:*:*:*:*:* | 2020r2 update_10 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:aveva_plant_scada:2023:-:*:*:*:*:*:* | 2023 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:aveva_plant_scada:2023:update_10:*:*:*:*:*:* | 2023 update_10 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:telemetry_server:2020r2:-:*:*:*:*:*:* | 2020r2 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:telemetry_server:2020r2:sp1:*:*:*:*:*:* | 2020r2 sp1 | Vulnerable | AVEVA |
- cpe:2.3:a:aveva:aveva_plant_scada:2020r2:-:*:*:*:*:*:* Versions 2020r2 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:aveva_plant_scada:2020r2:update_10:*:*:*:*:*:* Versions 2020r2 update_10 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:aveva_plant_scada:2023:-:*:*:*:*:*:* Versions 2023 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:aveva_plant_scada:2023:update_10:*:*:*:*:*:* Versions 2023 update_10 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:telemetry_server:2020r2:-:*:*:*:*:*:* Versions 2020r2 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:telemetry_server:2020r2:sp1:*:*:*:*:*:* Versions 2020r2 sp1 Vulnerable ·AVEVA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-1256
- 2026-10-03 Alias added: GHSA-22mx-qh6h-fcv2
References
Sources
- CVE-2023-1256 · CVE Program
- CVE-2023-1256 · NVD
- FIRST EPSS
- GHSA-22mx-qh6h-fcv2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences