AVEVA System Platform (Update A)

Risk Summary

Successful exploitation of these vulnerabilities, if exploited and chained together, could allow a malicious entity to achieve arbitrary code execution with system privileges or cause a denial-of-service condition.

CVEs (5)

Remediations

• AVEVA recommends organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.
• AutoBuild service is intended to be used only on the GR Node of System Platform during configuration. If the AutoBuild service is enabled on any Runtime nodes, it should be disabled. Furthermore, if the AutoBuild functionality is not used on the GR Node, the AutoBuild service can be disabled on the GR Node as an alternative mitigation that does not require patching.
• AVEVA recommends users who need to continually use the AutoBuild functionality and cannot disable it in System Platform Versions 2017 through 2020 R2 P01 (inclusive) are affected by the vulnerabilities and should first upgrade to one of the System Platform versions listed below, then apply the corresponding security update:
• System Platform 2020 R2 P01, 2020 R2, 2020: Apply AVEVA Communication Drivers Pack 2020 R2.1
• System Platform 2017 U3 SP1 P01:
• First apply AVEVA Communication Drivers Pack 2020 R2 AVEVA notes that Activated Licensing is required to apply AVEVA Communication Drivers Pack 2020 R2 on top of System Platform 2017 U3 SP1 P01. For information on AVEVA license compatibility, please contact AVEVA Customer Support
• Then apply AVEVA Communication Drivers Pack 2020 R2.1
• Please see AVEVA's security bulletin AVEVA-2021-002 for more information.

Affected Vendors

Affected Products (1)

Affected Sectors

Chemical, Critical Manufacturing, Energy, Food and Agriculture, and Water and Wastewater Systems