CVE-2021-32942
First published: Tue Jun 08 2021(Updated: )
The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Aveva Intouch 2017 | =update3 | |
| Aveva Intouch 2020 | ||
| Aveva Intouch 2020 | =r2 | |
| AVEVA Software, LLC InTouch 2020 R2 and all prior versions |
Remedy
AVEVA recommends organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation. Users of InTouch 2020 R2 and all prior versions are affected and should first upgrade to one of the versions listed below, then apply the corresponding security update: InTouch 2020 R2: Update to InTouch 2020 R2 P01 InTouch 2020: Update to Security Update 1216934InTouch 2017 U3 SP1 P01: Update to Security Update 1216933
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-32942?
CVE-2021-32942 is a vulnerability in AVEVA InTouch Runtime 2020 R2 and prior versions that could expose cleartext credentials if a privileged user creates a diagnostic memory dump and saves it to a non-protected location.
How does CVE-2021-32942 affect AVEVA InTouch?
CVE-2021-32942 affects AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) of the software.
How severe is CVE-2021-32942?
CVE-2021-32942 has a severity rating of 5.5 (Medium).
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-32942?
CVE-2021-32942 is associated with CWE-312 and CWE-316.
How can I protect against CVE-2021-32942?
To protect against CVE-2021-32942, it is recommended to update to the latest version of AVEVA InTouch Runtime or follow the mitigation steps provided by the software vendor.
- collector/nvd-index
- agent/type
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/description
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/event
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- vendor/aveva
- canonical/aveva intouch 2017
- version/aveva intouch 2017/update3
- canonical/aveva intouch 2020
- version/aveva intouch 2020/r2
- vendor/aveva software, llc
- canonical/aveva software, llc intouch 2020 r2 and all prior versions