CVE-2023-33873: AVEVA Operations Control Logger Execution with Unnecessary Privileges

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-15 · updated 2026-06-17
Weakness: CWE-250

Description

This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.

Affected products

AVEVA Batch Management: before 2020; 2020, 2020-sp1 — fixed in 2020
AVEVA Communication Drivers: before 2020; 2020, 2020-r2, 2020-r2_p01 — fixed in 2020
AVEVA Edge: through 20.1.101
AVEVA Enterprise Licensing: through 3.7.002
AVEVA Historian: before 2020; 2020, 2020-r2, 2020-r2_p01 — fixed in 2020
AVEVA InTouch: before 2020; 2020, 2020-r2, 2020-r2_p01 — fixed in 2020
AVEVA Manufacturing Execution System: before 2020; 2020, 2020-p01 — fixed in 2020
AVEVA Mobile Operator: before 2020; 2020, 2020-r1 — fixed in 2020
AVEVA Plant Scada: before 2020; 2020, 2020-r2 — fixed in 2020
AVEVA Recipe Management: before 2020; 2020, 2020-update_1_patch_2 — fixed in 2020
AVEVA System Platform: before 2020; 2020, 2020-r2, 2020-r2_p01 — fixed in 2020
AVEVA Telemetry Server: 2020r2, 2020r2-sp1
AVEVA Work Tasks: before 2020; 2020, 2020-update_1, 2020-update_2 — fixed in 2020

How to fix

Upgrade to a fixed version: AVEVA Batch Management 2020; AVEVA Communication Drivers 2020; AVEVA Historian 2020; AVEVA InTouch 2020; AVEVA Manufacturing Execution System 2020; AVEVA Mobile Operator 2020; AVEVA Plant Scada 2020; AVEVA Recipe Management 2020; AVEVA System Platform 2020; AVEVA Work Tasks 2020. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-33873 or the next vulnerability affects your stack