Security readout for executives and security teams
Plain-English summary
CVE-2021-43551 is a code-injection issue in OSIsoft PI Vision displays. An attacker who already has write access could poison a display, and a victim using Microsoft Internet Explorer could expose or alter PI System data within that victim’s permissions.
Executive priority
Treat as a moderate operational technology risk. It needs prompt review if PI Vision is used around sensitive process data, especially where Internet Explorer remains in use or many users can edit displays.
Technical view
The issue is CWE-79 cross-site scripting in OSIsoft PI Vision, listed as affecting all versions. Exploitation requires low privileges, high complexity, user interaction, and Microsoft Internet Explorer. Scope changes because injected code may affect PI System data and other data accessible to the viewer.
Likely exposure
Exposure is most relevant where PI Vision is deployed, display write permissions are broadly assigned, and users still view PI Vision content with Microsoft Internet Explorer. The source bundle does not identify specific patched versions.
Exploitation context
The CVE is not listed as CISA KEV in the provided bundle. Sources describe a remote attacker with write access and a victim using Internet Explorer; they do not provide evidence of active exploitation.
Researcher notes
Key constraints matter: attacker write access, victim interaction, and Internet Explorer are part of the described attack path. The bundle does not name a patch, workaround, proof of concept, or observed exploitation.
Mitigation direction
- Check OSIsoft or CISA advisory guidance for supported remediation.
- Review and restrict PI Vision display write permissions.
- Discourage or block Microsoft Internet Explorer use for PI Vision.
- Identify and review displays modified by low-privileged users.
- Monitor PI Vision for unexpected display changes.
Validation and detection
- Inventory OSIsoft PI Vision deployments and versions.
- Confirm who has write access to PI Vision displays.
- Determine whether any users still access PI Vision with Internet Explorer.
- Review recent display modifications for unexpected embedded code.
- Verify vendor guidance has been evaluated and applied.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-43551 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N1.34.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://us-cert.cisa.gov/ics/advisories/icsa-21-313-05CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.