CVE:CVE-2020-10610
CNNVD:CNNVD-202005-697
OSIsoft Osisoft PI Asset Framework（AF）等都是美国OSIsoft公司的产品。Osisoft PI Asset Framework是一款用于以资产为中心的模型、层次结构、对象和设备的存储库。OSIsoft PI Software Development Kit（SDK）是一款提供访问PI服务器的编程库。OSIsoft PI API（Application Programming Interface）是一款支持在PI Data Archive中读取和写入值的函数库。
多款Osisoft产品中存在代码问题漏洞。本地攻击者可利用该漏洞修改搜索目录，注入二进制文件，控制本地电脑，进而未授权查看，删除或修改信息。以下产品及版本受到影响：Osisoft PI AF Clien 2018 SP3 Patch 1 2.10.7.283及之前版本；PI SDK 2018 SP1 1.4.7.602及之前版本；PI API for Windows Integrated Security 2.0.2.5及之前版本；PI API 1.6.8.26及之前版本；PI Buffer Subsystem 4.8.0.18及之前版本；PI Connector for BACnet 1.2.0.6及之前版本；PI Connector for CygNet 1.4.0.17及之前版本；PI Connector for DC Systems RTscada 1.2.0.42及之前版本；PI Connector for Ethernet/IP 1.1.0.10及之前版本；PI Connector for HART-IP 1.3.0.1及之前版本；PI Connector for Ping 1.0.0.54及之前版本；PI Connector for Wonderware Historian 1.5.0.88及之前版本；PI Connector Relay 2.5.19.0及之前版本；PI Data Archive 2018 SP3 3.4.430.460及之前版本；PI Data Collection Manager 2.5.19.0及之前版本；PI Integrator for Business Analytics 2018 R2 SP1 2.2.0.183及之前版本；PI Interface Configuration Utility 1.5.0.7及之前版本；PI to OCS 1.1.36.0及之前版本。
solution:Upgrade osisoft pi_api to a higher version than 1.6.8.26,2.0.2.5,and avoid the version (,1.6.8.26],(,2.0.2.5]; Upgrade osisoft pi_buffer_subsystem to a higher version than 4.8.0.18,and avoid the version (,4.8.0.18]; Upgrade osisoft pi_connector to a higher version than 1.0.0.54,1.1.0.10,1.2.0.6,1.2.0.42,1.2.1.71,1.2.2.79,1.3.0.1,1.3.0.130,1.3.1.135,1.4.0.17,1.5.0.88,and avoid the version (,1.0.0.54],(,1.1.0.10],(,1.2.0.6],(,1.2.0.42],(,1.2.1.71],(,1.2.2.79],(,1.3.0.1],(,1.3.0.130],(,1.3.1.135],(,1.4.0.17],(,1.5.0.88]; Upgrade osisoft pi_connector_relay to a higher version than 2.5.19.0,and avoid the version (,2.5.19.0]; Upgrade osisoft pi_data_archive to a higher version than 3.4.430.460,and avoid the version (,3.4.430.460]; Upgrade osisoft pi_data_collection_manager to a higher version than 2.5.19.0,and avoid the version (,2.5.19.0]; Upgrade osisoft pi_integrator to a higher version than 2.2.0.183,and avoid the version (,2.2.0.183]; Upgrade osisoft pi_interface_configuration_utility to a higher version than 1.5.0.7,and avoid the version (,1.5.0.7]; Upgrade osisoft pi_to_ocs to a higher version than 1.1.36.0,and avoid the version (,1.1.36.0]