CVE-2020-25163
Last modified
CVE-2020-25163 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. A remote attacker with write access to PI ProcessBook files could inject code that is imported into OSIsoft PI Vision 2020 versions prior to 3.5.0. Unauthorized information disclosure, modification, or deletion is also possible if a victim views or interacts with the infected display. EPSS estimates a 0.88% chance of exploitation in the next 30 days.
Description
A remote attacker with write access to PI ProcessBook files could inject code that is imported into OSIsoft PI Vision 2020 versions prior to 3.5.0. Unauthorized information disclosure, modification, or deletion is also possible if a victim views or interacts with the infected display. This vulnerability affects PI System data and other data accessible with victim’s user permissions.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Osisoft | Pi Vision | < 2020 |
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-20-315-02Third Party Advisory, US Government Resource
- https://www.cisa.gov/uscert/ics/advisories/icsa-20-315-02Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-25163?
How severe is CVE-2020-25163?
How do I fix CVE-2020-25163?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-25158A reflected cross-site scripting (XSS) vulnerability in the …6.1
- CVE-2020-25159499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable t…9.8
- CVE-2020-2516Vulnerability in the Core RDBMS component of Oracle Database…2.4
- CVE-2020-25160Improper access controls in the B. Braun Melsungen AG SpaceC…6.3
- CVE-2020-25161The WADashboard component of WebAccess/SCADA Versions 9.0 an…8.8
- CVE-2020-25162A XPath injection vulnerability in the B. Braun Melsungen AG…7.5
- CVE-2020-25164A vulnerability in the B. Braun Melsungen AG SpaceCom Versio…7.5
- CVE-2020-25165BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier a…7.5
- CVE-2020-25166An improper verification of the cryptographic signature of f…7.1
- CVE-2020-25167OSIsoft PI Vision 2020 versions prior to 3.5.0 could disclos…6.5
- CVE-2020-25168Hard-coded credentials in the B. Braun Melsungen AG SpaceCom…3.3
- CVE-2020-25169The affected Reolink P2P products do not sufficiently protec…7.5
Are you affected by CVE-2020-25163?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST