Security readout for executives and security teams
Plain-English summary
AVEVA InTouch Runtime 2020 R2 and earlier may expose credentials in cleartext if a privileged user creates a WindowViewer diagnostic memory dump and stores it somewhere unprotected. This is not a remote break-in by itself, but mishandled dumps could hand attackers reusable credentials.
Executive priority
Treat this as a focused operational hygiene issue for affected OT environments. Prioritize if InTouch systems are business-critical, dumps are routinely collected, or dump storage is broadly accessible. It is not evidenced as actively exploited in the provided sources.
Technical view
CVE-2021-32942 is a CWE-316 cleartext credential exposure in AVEVA InTouch Runtime WindowViewer. The condition requires local access and an authorized privileged user creating a diagnostic memory dump, then saving it to a non-protected location. CVSS 3.1 is 6.6, with high confidentiality and integrity impact and no availability impact.
Likely exposure
Exposure is likely limited to organizations running AVEVA InTouch Runtime 2020 R2 or earlier, especially environments where administrators collect diagnostics and store dumps on shared, weakly protected, or long-retained locations.
Exploitation context
The source bundle does not show active exploitation, and the CVE is not marked CISA KEV. Abuse depends on access to diagnostic memory dumps or the ability of a privileged authorized user to create and mishandle them.
Researcher notes
Evidence is limited to the CVE metadata and public advisory references. The vulnerable condition is narrow: credential material in memory becomes exposed through diagnostic dump handling. Do not assume remote exploitability, affected versions beyond stated Runtime 2020 R2 and prior, or a specific patch without vendor confirmation.
Mitigation direction
- Check AVEVA security guidance for product-specific updates or mitigations.
- Restrict diagnostic dump creation to trusted administrators only.
- Store memory dumps only in protected, access-controlled locations.
- Find and remove or secure existing WindowViewer dump files.
- Limit and monitor access to affected InTouch Runtime hosts.
Validation and detection
- Inventory AVEVA InTouch Runtime versions and identify 2020 R2 or earlier.
- Confirm whether WindowViewer diagnostic dumps are created operationally.
- Review dump storage paths for weak permissions or shared access.
- Check for existing dump files in non-protected locations.
- Verify vendor advisory status and remediation guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-316: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-32942 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N1.35.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.6MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03CVE reference · x_refsource_MISC
- https://www.aveva.com/en/support/cyber-security-updates/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.