Description
The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.
References (2)
Core 2
Core References
Patch, Third Party Advisory, US Government Resource x_refsource_misc
https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03
Patch, Vendor Advisory x_refsource_misc
https://www.aveva.com/en/support/cyber-security-updates/
Scores
CVSS v3
6.6
EPSS
0.0018
EPSS Percentile
7.8%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Details
CWE
CWE-316
CWE-312
Status
published
Products (3)
aveva/intouch_2017
aveva/intouch_2020
aveva/intouch_2020
r2
Published
Jun 09, 2021
Tracked Since
Feb 18, 2026