Skip to content
Fencer Vulns
high 7.8

CVE-2020-10608 json

In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI S…

published 2020-07-24 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-3056

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits
0
none known

Summary

In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. This exploitation can target another local user of PI System software on the computer to escalate privilege and result in unauthorized information disclosure, deletion, or modification.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-20-133-02 updated cvss 7.8

OSIsoft PI System (Update A)

  • OSIsoft LLC Applications using PI Asset Framework (AF) Client <= PI AF Client 2018 SP3 Patch 1 Version 2.10.7.283 OSIsoft LLC Applications using PI Software Development Kit (SDK) <= PI SDK 2018 SP1 Version 1.4.7.602 OSIsoft LLC PI API <= 1.6.8.26 OSIsoft LLC PI API for Windows Integrated Security <= 2.0.2.5 OSIsoft LLC PI Buffer Subsystem <= 4.8.0.18 OSIsoft LLC PI Connector for BACnet <= 1.2.0.6
    +19 more products
    OSIsoft LLC PI Connector for CygNet <= 1.4.0.17 OSIsoft LLC PI Connector for DC Systems RTscada <= 1.2.0.42 OSIsoft LLC PI Connector for Ethernet/IP <= 1.1.0.10 OSIsoft LLC PI Connector for HART-IP <= 1.3.0.1 OSIsoft LLC PI Connector for IEC 60870-5-104 versions <= 1.2.2.79 OSIsoft LLC PI Connector for OPC-UA <= 1.3.0.130 OSIsoft LLC PI Connector for Ping <= 1.0.0.54 OSIsoft LLC PI Connector for Siemens Simatic PCS 7 <= 1.2.1.71 OSIsoft LLC PI Connector for UFL <= 1.3.1.135 OSIsoft LLC PI Connector for Wonderware Historian <= 1.5.0.88 OSIsoft LLC PI Connector Relay <= 2.5.19.0 OSIsoft LLC PI Data Archive 2018, 2018 SP2, <= 2018 SP3 Version 3.4.430.460, <= 2018 SP2 OSIsoft LLC PI Data Collection Manager <= 2.5.19.0 OSIsoft LLC PI Integrator for Business Analytics <= 2018 R2 SP1 Version 2.2.0.183 OSIsoft LLC PI Interface Configuration Utility (ICU) <= 1.5.0.7 OSIsoft LLC PI Manual Logger <= 2017 R2 Patch 1 OSIsoft LLC PI to OCS <= 1.1.36.0 OSIsoft LLC PI Vision <= 2019 OSIsoft LLC RtReports <= 4.1
    affected: vendor fix customers.osisoft.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • n/a OSIsoft PI System multiple products and versions

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.