2 lines
3.6 KiB
JSON
2 lines
3.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Pipeline Simulation 2025","vendor":"AVEVA","versions":[{"lessThanOrEqual":"2025 SP1 (build 7.1.9497.6351)","status":"affected","version":"0","versionType":"custom"}]}],"source":"ics-cert@hq.dhs.gov"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records."},{"lang":"es","value":"La vulnerabilidad, si se explota, podría permitir a un malhechor no autenticado realizar operaciones destinadas únicamente a los roles de Instructor de Simulador o Desarrollador de Simulador (Administrador), lo que resultaría en una escalada de privilegios con potencial para la modificación de parámetros de simulación, configuración de entrenamiento y registros de entrenamiento."}],"id":"CVE-2026-5387","lastModified":"2026-10-26T21:10:00.170","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5387","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-15T17:38:40.210058Z","version":"2.0.3"}}]},"published":"2026-04-15T16:16:39.007","references":[{"source":"ics-cert@hq.dhs.gov","url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-04.json"},{"source":"ics-cert@hq.dhs.gov","url":"https://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f"},{"source":"ics-cert@hq.dhs.gov","url":"https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-004.pdf"},{"source":"ics-cert@hq.dhs.gov","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-04"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]}
|