CVE-2020-10608

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. This exploitation can target another local user of PI System software on the computer to escalate privilege and result in unauthorized information disclosure, deletion, or modification.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
n/a	OSIsoft PI System multiple products and versions	OSIsoft PI System multiple products and versions

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-133-02Third Party Advisory, US Government Resource

Timeline

Published: Jul 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-106097.5Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to be read or allow modification to system se CVE-2020-10617.5A remote code execution vulnerability exists in the way that the Microsoft Script Runtime handles objects in memory. The vulnerability could CVE-2020-106107.8In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI CVE-2020-106119.8Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers to execute arbitrary cod CVE-2020-106129.1Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is CVE-2020-106137.5Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers to disclose sensitive in CVE-2020-106144.8In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject CVE-2020-106157.5Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers cause a denial-of-servic CVE-2020-106168.8Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does not specify the path of multiple imported .dll files. Therefore, an attacker can CVE-2020-106177.5There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to CVE-2020-106185.5LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to sensitive information exposure by unauthorized users.CVE-2020-106199.1An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control.