CVE-2023-31274

Missing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server

Description

AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of a PI Server to consume available memory resulting in throttled processing of new PI Data Archive events and a partial denial-of-service condition.

Remediation

Solution:

  • All affected versions can be fixed by upgrading to AVEVA PI Server version 2023 Patch 1 or later. From OSI Soft Customer Portal https://my.osisoft.com/ , search for “PI Server” and select version “2023 Patch 1”. For an alternative fix, AVEVA PI Server 2018 SP3 Patch 5 and prior can be fixed by deploying AVEVA PI Server version 2018 SP3 Patch 6 or later. From OSI Soft Customer Portal https://my.osisoft.com/ , search for “PI Server” and select version “2018 SP3 Patch 6”. AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected products should apply security updates as soon as possible. AVEVA recommends the following defensive measures: * Set the PI Message Subsystem to auto restart. * Monitor the memory usage of the PI Message Subsystem. * Limit network access to port 5450 to trusted workstations and software * Confirm that only authorized users have access to write to the PI Server Message Log. This is done through configuration of the PIMSGSS entry within the Database Security plugin accessible through PI System Management Tools. For more information on this vulnerability, including security updates, users should see security bulletin AVEVA-2024-001 https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2024-001.pdf .

Category

5.3
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.12%
Third-Party Advisory cisa.gov
Affected: Aveva PI Server
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01 government resource mitigation third party advisory us government resource

Frequently Asked Questions

What is the severity of CVE-2023-31274?
CVE-2023-31274 has been scored as a medium severity vulnerability.
How to fix CVE-2023-31274?
To fix CVE-2023-31274: All affected versions can be fixed by upgrading to AVEVA PI Server version 2023 Patch 1 or later. From OSI Soft Customer Portal https://my.osisoft.com/ , search for “PI Server” and select version “2023 Patch 1”. For an alternative fix, AVEVA PI Server 2018 SP3 Patch 5 and prior can be fixed by deploying AVEVA PI Server version 2018 SP3 Patch 6 or later. From OSI Soft Customer Portal https://my.osisoft.com/ , search for “PI Server” and select version “2018 SP3 Patch 6”. AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected products should apply security updates as soon as possible. AVEVA recommends the following defensive measures: * Set the PI Message Subsystem to auto restart. * Monitor the memory usage of the PI Message Subsystem. * Limit network access to port 5450 to trusted workstations and software * Confirm that only authorized users have access to write to the PI Server Message Log. This is done through configuration of the PIMSGSS entry within the Database Security plugin accessible through PI System Management Tools. For more information on this vulnerability, including security updates, users should see security bulletin AVEVA-2024-001 https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2024-001.pdf .
Is CVE-2023-31274 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2023-31274 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-31274?
CVE-2023-31274 affects Aveva PI Server.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.