Vulnerability · Published Jan 18, 2024 · Assigned by icscert

CVE-2023-34348Improper Check or Handling of Exceptional Conditions in Aveva PI Server

High 7.5

In plain English

A high-severity security flaw in PI Server from Aveva. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 53.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to remotely crash the PI Message Subsystem of a PI Server, resulting in a denial-of-service condition.

Affected products (as reported)

Vendor	Product	Versions
Aveva	PI Server	20230 – through 2018 SP3 P05

Weakness: CWE-703, CWE-754 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01 government-resource