What’s Vulnerable › Vulnerabilities

CVE-2021-38410: AVEVA PCS Portal Uncontrolled Search Path Element

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-27 · updated 2026-06-17
• Weakness: CWE-427

Description

AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path.

Affected products

• AVEVA Batch Management: 2020
• AVEVA Enterprise Data Management: 2020
• AVEVA Manufacturing Execution System: 2020
• AVEVA Mobile Operator: 2020
• AVEVA Platform Common Services: 4.4.6, 4.5.0, 4.5.1, 4.5.2
• AVEVA System Platform: 2020, 2020-r2, 2020-r2_p01
• AVEVA Work Tasks: 2020, 2020-update_1

References

• https://www.aveva.com/en/support-and-success/cyber-security-updates/
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-01
• https://www.aveva.com/en/support-and-success/cyber-security-updates/
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-01

Get alerted when CVE-2021-38410 or the next vulnerability affects your stack