PatchTheCVECVE-2021-38410: AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to
29
Routine
HIGH 7.3DOWNGRADEDOWNGRADEDOWNGRADE
CVE-2021-38410 is a high-severity flaw (CVSS 7.3) affecting batch management, enterprise data management, manufacturing execution system. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path.
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.3 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 87%) |
| CISA exploited list | No |
| Weakness | CWE-427 |
| Published | 2022-07-27 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
aveva batch management DOWNGRADE
Affected: 2020
Fixed in: no fixed release known
Safe to downgrade to: a release before 2020
1. Check installed version
apt-cache policy batch-management || rpm -q batch-management || batch-management --version
2. No fixed release: DOWNGRADE to a release before 2020 (Debian / Ubuntu)
apt-cache madison batch-management
sudo apt install batch-management=<VERSION_BEFORE_2020>
sudo apt-mark hold batch-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list batch-management
sudo dnf downgrade batch-management-<VERSION_BEFORE_2020>
sudo dnf versionlock add batch-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
aveva enterprise data management DOWNGRADE
Affected: 2020
Fixed in: no fixed release known
Safe to downgrade to: a release before 2020
1. Check installed version
apt-cache policy enterprise-data-management || rpm -q enterprise-data-management || enterprise-data-management --version
2. No fixed release: DOWNGRADE to a release before 2020 (Debian / Ubuntu)
apt-cache madison enterprise-data-management
sudo apt install enterprise-data-management=<VERSION_BEFORE_2020>
sudo apt-mark hold enterprise-data-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list enterprise-data-management
sudo dnf downgrade enterprise-data-management-<VERSION_BEFORE_2020>
sudo dnf versionlock add enterprise-data-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
aveva manufacturing execution system DOWNGRADE
Affected: 2020
Fixed in: no fixed release known
Safe to downgrade to: a release before 2020
1. Check installed version
apt-cache policy manufacturing-execution-system || rpm -q manufacturing-execution-system || manufacturing-execution-system --version
2. No fixed release: DOWNGRADE to a release before 2020 (Debian / Ubuntu)
apt-cache madison manufacturing-execution-system
sudo apt install manufacturing-execution-system=<VERSION_BEFORE_2020>
sudo apt-mark hold manufacturing-execution-system
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list manufacturing-execution-system
sudo dnf downgrade manufacturing-execution-system-<VERSION_BEFORE_2020>
sudo dnf versionlock add manufacturing-execution-system
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
aveva mobile operator DOWNGRADE
Affected: 2020
Fixed in: no fixed release known
Safe to downgrade to: a release before 2020
1. Check installed version
apt-cache policy mobile-operator || rpm -q mobile-operator || mobile-operator --version
2. No fixed release: DOWNGRADE to a release before 2020 (Debian / Ubuntu)
apt-cache madison mobile-operator
sudo apt install mobile-operator=<VERSION_BEFORE_2020>
sudo apt-mark hold mobile-operator
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list mobile-operator
sudo dnf downgrade mobile-operator-<VERSION_BEFORE_2020>
sudo dnf versionlock add mobile-operator
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
aveva platform common services DOWNGRADE
Affected: 4.4.6 · 4.5.0 · 4.5.1 · 4.5.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.4.6
1. Check installed version
apt-cache policy platform-common-services || rpm -q platform-common-services || platform-common-services --version
2. No fixed release: DOWNGRADE to a release before 4.4.6 (Debian / Ubuntu)
apt-cache madison platform-common-services
sudo apt install platform-common-services=<VERSION_BEFORE_4.4.6>
sudo apt-mark hold platform-common-services
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list platform-common-services
sudo dnf downgrade platform-common-services-<VERSION_BEFORE_4.4.6>
sudo dnf versionlock add platform-common-services
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
aveva system platform DOWNGRADE
Affected: 2020 · 2020 r2 · 2020 r2_p01
Fixed in: no fixed release known
Safe to downgrade to: a release before 2020
1. Check installed version
apt-cache policy system-platform || rpm -q system-platform || system-platform --version
2. No fixed release: DOWNGRADE to a release before 2020 (Debian / Ubuntu)
apt-cache madison system-platform
sudo apt install system-platform=<VERSION_BEFORE_2020>
sudo apt-mark hold system-platform
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list system-platform
sudo dnf downgrade system-platform-<VERSION_BEFORE_2020>
sudo dnf versionlock add system-platform
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-38410?
batch management: downgrade or apply the listed mitigation; enterprise data management: downgrade or apply the listed mitigation; manufacturing execution system: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2021-38410 being exploited?
CVE-2021-38410 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-38410 affect?
CVE-2021-38410 affects batch management, enterprise data management, manufacturing execution system. Severity is high (CVSS 7.3). AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the se
How urgent is CVE-2021-38410?
Priority 29/100. High severity
Related CVEs
- CVE-2023-34982 MEDIUM 5.5 UPGRADE UPGRADE This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard pr
- CVE-2023-33873 HIGH 7.8 UPGRADE UPGRADE This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standar