Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2024-3468

Deserialization of Untrusted Data in AVEVA PI Web API

High8.4EPSS 0.42%
Published
Updated
Reserved
Assigned by
icscert

Description

There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.

Timeline

  1. ID reserved

    By icscert

  2. · 2 months later

    Published

  3. · 50 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-3468, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)4.0High8.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
NVDNVD · Deferred4.0High8.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.42% · top 64% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.

Weakness

Affected products

What to do

Solution: AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected products should apply security updates as soon as possible: From OSI Soft Customer Portal https://my.osisoft.com/ , search for "PI Web API" and select version "2023 SP1" or later. (Alternative) PI Web API 2021 SP3 can be fixed by upgrading PI AF Client to one of the versions specified in AVEVA Security Bulletin AVEVA-2024-004 / ICSA-24-163-03 AVEVA further recommends users follow general defensive measures: * Set "DisableWrites" configuration setting to true, if this instance of PI Web API is used only for reading data or GET requests. * Uninstall Core Endpoints feature if this instance of PI Web API is used only for data collection from AVEVA Adapters. Keep OMF feature installed. * Limit AF Servers' Administrators, so that most of the PI Web API user accounts don't have the permission to change the backend AF servers. For additional information please refer to AVEVA-2024-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-3468 badge
[![CVE-2024-3468](https://trackcve.app/badge/CVE-2024-3468.svg)](https://trackcve.app/cve/CVE-2024-3468)

Record last updated .