CVE-2021-33008
📋 TL;DR
CVE-2021-33008 is an authentication bypass vulnerability in AVEVA System Platform versions 2017 through 2020 R2 P01. It allows unauthenticated attackers to access functionality that should require user authentication, potentially leading to unauthorized system control. This affects industrial control systems using these AVEVA products.
💻 Affected Systems
- AVEVA System Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems, allowing attackers to manipulate critical processes, cause physical damage, disrupt operations, or exfiltrate sensitive industrial data.
Likely Case
Unauthorized access to system functionality, configuration changes, data theft, and potential disruption of industrial operations.
If Mitigated
Limited impact if proper network segmentation and access controls are implemented, though authentication bypass remains possible within allowed network zones.
🎯 Exploit Status
Authentication bypass vulnerabilities typically have low exploitation complexity once the vulnerable endpoint is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2020 R2 P02 and later
Vendor Advisory: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf
Restart Required: Yes
Instructions:
1. Download patch from AVEVA support portal. 2. Backup current installation. 3. Apply patch following vendor instructions. 4. Restart system. 5. Verify authentication is now required for all functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate AVEVA System Platform systems from untrusted networks using firewalls and VLANs.
Access Control Lists
allImplement strict network access controls to limit connections to trusted IP addresses only.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy intrusion detection systems to monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check System Platform version; if between 2017 and 2020 R2 P01 inclusive, system is vulnerable.Check Version:
Check version in AVEVA System Platform About dialog or installation directory properties.Verify Fix Applied:
Verify version is 2020 R2 P02 or later, and test that authentication is required for all system functionality.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access attempts to system functionality
- Authentication bypass patterns in application logs
Network Indicators:
- Unusual network traffic to AVEVA System Platform ports from unauthorized sources
SIEM Query:
source_ip NOT IN (trusted_ips) AND destination_port IN (AVEVA_ports) AND authentication_status = 'none'🔗 References
- https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05
- https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05
