Aveva Intouch 2017 vulnerabilities

2 CVEs affecting Aveva Intouch 2017, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-32942, published 2021-06-09.

More from Aveva.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-10628, published 2018-07-24. Critical severity, CVSS 9.8. EPSS: 5.4% chance of exploitation in the next 30 days. AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on…
• CVE-2021-32942, published 2021-06-09. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the…