What’s Vulnerable › Vulnerabilities

CVE-2020-10610

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-24 · updated 2026-06-17
• Weakness: CWE-427

Description

In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification.

Affected products

• OSIsoft Pi Api: through 1.6.8.26; through 2.0.2.5
• OSIsoft Pi Buffer Subsystem: through 4.8.0.18
• OSIsoft Pi Connector: through 1.0.0.54; through 1.1.0.10; through 1.2.0.6; through 1.2.0.42; through 1.2.1.71; through 1.2.2.79
• OSIsoft Pi Connector Relay: through 2.5.19.0
• OSIsoft PI Data Archive: through 3.4.430.460
• OSIsoft Pi Data Collection Manager: through 2.5.19.0
• OSIsoft Pi Integrator: through 2.2.0.183
• OSIsoft Pi Interface Configuration Utility: through 1.5.0.7
• OSIsoft Pi To Ocs: through 1.1.36.0

References

• https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02
• https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02

Get alerted when CVE-2020-10610 or the next vulnerability affects your stack