← Vulnerability feed

Vulnerability record · CVE-2023-1256 · published 16 March 2023

CVE-2023-1256: Aveva plant scada vulnerability

Aveva · Aveva Plant Scada

The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.

9.8 CVSS 3.1 Critical EPSS 0.68% · top 49.6%
9.8CVSS 3.1 base score
0.68%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-04 Third Party AdvisoryUS Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-04 Third Party AdvisoryUS Government Resource

Track CVE-2023-1256 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2023-33873Aveva batch management execution with unnecessary privileges vulnerabilityThis privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privi…EPSS 0.24%7.1CVE-2023-34982Aveva batch management vulnerabilityThis external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System pri…EPSS 0.22%

Source: NIST National Vulnerability Database (record CVE-2023-1256), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.