title: AVEVA SuiteLink Server Null Pointer Dereference
description: Null pointer dereference in SuiteLink server while processing commands 0x03/0x10
problem types: CWE-476 NULL Pointer Dereference
affected:
{
product: AVEVA System Platform 2020
vendor: AVEVA Software, LLC
versions:
lessThanOrEqual: R2 P01, status: affected, version: unspecified, versionType: custom
}
{
product: AVEVA InTouch 2020
vendor: AVEVA Software, LLC
versions:
lessThanOrEqual: R2 P01, status: affected, version: unspecified, versionType: custom
}
{
product: AVEVA Historian 2020
vendor: AVEVA Software, LLC
versions:
lessThanOrEqual: R2 P01, status: affected, version: unspecified, versionType: custom
}
{
product: AVEVA Communication Drivers Pack 2020
vendor: AVEVA Software, LLC
versions:
lessThanOrEqual: R2, status: affected, version: unspecified, versionType: custom
}
{
product: AVEVA Batch Management 2020
vendor: AVEVA Software, LLC
versions:
lessThanOrEqual: 2020, status: affected, version: unspecified, versionType: custom
}
{
product: AVEVA MES 2014
vendor: AVEVA Software, LLC
versions:
lessThanOrEqual: R2, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
solutions: AVEVA recommends organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.
Users with affected versions of these products should apply the corresponding security update. Note a subset of the updates requires activation-based licensing.
Please see AVEVA security bulletin AVEVA-2021-003 for more information.