Security Resilience

CVE-2023-33873

LPE in Aveva Communication Drivers ≤ 2020

LPE
Published
15 November 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0024 14th percentile
Risk Priority 55 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-33873 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Aveva Communication Drivers. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.

CWE(s)
CWE-250NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
T1011 Exfiltration Over Other Network Medium Exfiltration
Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.
attack.mitre.org →
T1027.003 Steganography Stealth
Adversaries may use steganography techniques in order to prevent the detection of hidden information.
attack.mitre.org →
T1027.004 Compile After Delivery Stealth
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-34982Same product: Aveva Batch Management
CVE-2023-6132Same product: Aveva Batch Management
CVE-2026-65162Shared CWE-250
CVE-2026-69464Shared CWE-250
CVE-2025-43990Shared CWE-250
CVE-2024-45034Shared CWE-250
CVE-2024-27110Shared CWE-250
CVE-2026-42061Shared CWE-250
CVE-2024-7387Shared CWE-250
CVE-2025-33120Shared CWE-250

Affected Assets

aveva
batch management
2020 · ≤ 2020
aveva
communication drivers
2020 · ≤ 2020
aveva
edge
≤ 20.1.101
aveva
enterprise licensing
≤ 3.7.002
aveva
historian
2020 · ≤ 2020
aveva
intouch
2020 · ≤ 2020
aveva
manufacturing execution system
2020 · ≤ 2020
aveva
mobile operator
2020 · ≤ 2020
aveva
plant scada
2020 · ≤ 2020
aveva
recipe management
2020 · ≤ 2020
+3 more product configuration(s) — see NVD for full list

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.2.3
  • V13.2.2

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures
addresses: CWE-250

Policy promotes least privilege by defining necessary privileges and management commitment to them.

AC-13 Supervision and Review — Access Control
addresses: CWE-250

Supervision detects and allows removal of unnecessary privileges that enable execution with excess rights.

AC-2 Account Management
addresses: CWE-250

Reviewing accounts for compliance, disabling/removing unneeded accounts, and aligning with termination processes prevents execution with unnecessary privileges.

AC-5 Separation of Duties
addresses: CWE-250

Separation of duties prevents any single user from holding all privileges needed to complete a critical task, directly reducing execution with unnecessary privileges.

AC-6 Least Privilege
addresses: CWE-250

Directly prevents execution with more privileges than needed for assigned tasks.

AT-3 Role-based Training
addresses: CWE-250

Role-based training on least privilege principles reduces the chance personnel assign or retain unnecessary privileges.

AU-6 Audit Record Review, Analysis, and Reporting
addresses: CWE-250

Analysis of audit records can identify execution with unnecessary privileges through unusual activity patterns.

CA-9 Internal System Connections
addresses: CWE-250

Automatic termination after a defined period eliminates unnecessary privileges from persistent connections.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
blocks

PR.AA-05 directly enforces least privilege so largely eliminates CWE-250 at design time, yet the weakness can still arise from runtime escalation paths, third-party code, or misapplied role definitions outside this single control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
blocks

A.5.15's policy, requirements, and rules for determining/minimizing access rights (incl. privileged access restrictions, need-to-know, least-privilege-like mapping, and role-based consistency) directly stop most unnecessary-privilege execution by design; bounded remainder is runtime elevation or misconfigured enforcement that still requires other controls (e.g. 8.2, 8.3) to act.

A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
blocks

Requiring explicit justification and time-limited grants discourages the routine allocation of unnecessary privileges that would otherwise allow execution with more rights than required.

A.5.35 Independent review of information security partial match
finds

Independent scrutiny can identify processes or services still running with unnecessary privileges and drive their reduction before an attacker can abuse them.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Windows 10 (1 rule)
  • V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. blocks CWE-250
Windows Server 2016 (1 rule)
  • V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. blocks CWE-250
Windows Server 2019 (1 rule)
  • V-205746 Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. blocks CWE-250

References