PT-2024-1192 · Aveva · Aveva Pi Server

Aveva · Published 2024-01-18 · Updated 2024-10-21 · CVE-2023-34348

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior

Description The issue is related to the incorrect handling of exceptional states in the AVEVA PI Server component, which is responsible for storing, normalizing, analyzing, and notifying data in real-time. This could allow an unauthenticated user to remotely crash the PI Message Subsystem of a PI Server, resulting in a denial-of-service condition.

Recommendations For AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior, consider applying a patch or fix to resolve the issue, however, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the PI Message Subsystem to minimize the risk of exploitation.

Improper Handling of Exceptional Conditions

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-754

CWE-703

Related Identifiers

BDU:2024-00519

CVE-2023-34348

Affected Products

Aveva Pi Server

References · 8

• https://bdu.fstec.ru/vul/2024-00519 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34348 · Security Note
• https://aveva.com/content/dam/aveva/documents/support/cyber-security-updates/Security_Bulletin_AVEVA-2024-001.pdf · Note
• https://twitter.com/CVEnew/status/1748037700332982687 · Twitter Post
• https://t.me/cvenotify/68832 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-018-01 · Note
• https://t.me/cvenotify/98926 · Telegram Post