CVE-2024-3468

Deserialization of Untrusted Data in AVEVA PI Web API

Description

There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.

Remediation

Solution:

  • AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected products should apply security updates as soon as possible: From OSI Soft Customer Portal https://my.osisoft.com/ , search for "PI Web API" and select version "2023 SP1" or later. (Alternative) PI Web API 2021 SP3 can be fixed by upgrading PI AF Client to one of the versions specified in AVEVA Security Bulletin AVEVA-2024-004 / ICSA-24-163-03 AVEVA further recommends users follow general defensive measures: * Set "DisableWrites" configuration setting to true, if this instance of PI Web API is used only for reading data or GET requests. * Uninstall Core Endpoints feature if this instance of PI Web API is used only for data collection from AVEVA Adapters. Keep OMF feature installed. * Limit AF Servers' Administrators, so that most of the PI Web API user accounts don't have the permission to change the backend AF servers. For additional information please refer to AVEVA-2024-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/

Category

8.4
CVSS
Severity: High
CVSS 4.0 •
EPSS 0.21%
Affected: AVEVA PI Web API
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-02 government resource

Frequently Asked Questions

What is the severity of CVE-2024-3468?
CVE-2024-3468 has been scored as a high severity vulnerability.
How to fix CVE-2024-3468?
To fix CVE-2024-3468: AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected products should apply security updates as soon as possible: From OSI Soft Customer Portal https://my.osisoft.com/ , search for "PI Web API" and select version "2023 SP1" or later. (Alternative) PI Web API 2021 SP3 can be fixed by upgrading PI AF Client to one of the versions specified in AVEVA Security Bulletin AVEVA-2024-004 / ICSA-24-163-03 AVEVA further recommends users follow general defensive measures: * Set "DisableWrites" configuration setting to true, if this instance of PI Web API is used only for reading data or GET requests. * Uninstall Core Endpoints feature if this instance of PI Web API is used only for data collection from AVEVA Adapters. Keep OMF feature installed. * Limit AF Servers' Administrators, so that most of the PI Web API user accounts don't have the permission to change the backend AF servers. For additional information please refer to AVEVA-2024-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/
Is CVE-2024-3468 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-3468 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-3468?
CVE-2024-3468 affects AVEVA PI Web API.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.