CVE-2024-3467: Deserialization of Untrusted Data in AVEVA PI Asset Framework Client

Published Jun 12, 2024

Updated

There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privileges of an interactive user that was socially engineered to import XML supplied by an attacker.

Affected Software

2 affected components

AVEVA PI Asset Framework Client=2018-sp3_patch_4

AVEVA PI Asset Framework Client=2023

Remediation

Information

AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected products should apply security updates as soon as possible: * (Recommended) All affected versions can be fixed by upgrading to PI AF Client 2023 Patch 1 or later: From OSI Soft Customer Portal https://my.osisoft.com/ , search for "Asset Framework" and select "PI Asset Framework (AF) Client 2023 Patch 1" or later. * (Alternative) AF Client 2018 SP3 P04 and prior can be fixed by deploying PI AF Client 2018 SP3 Patch 5 or later: From OSI Soft Customer Portal https://my.osisoft.com/ , search for "Asset Framework" and select either "PI Asset Framework (AF) Client 2018 SP3 Patch 5" or later. AVEVA further recommends users follow general defensive measures: * Run PI System Explorer as a least privilege interactive account when possible. * Establish procedures for verifying the source of XML is trusted before importing into PI System Explorer. For additional information please refer to AVEVA-2024-004 https://www.aveva.com/en/support-and-success/cyber-security-updates/

Event History

Jun 12, 2024

CVE Published

via MITRE·09:04 PM

Data Sourced

via MITRE·09:04 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-3467?

CVE-2024-3467 is considered a critical vulnerability due to its potential to allow remote code execution.

How do I fix CVE-2024-3467?

To remediate CVE-2024-3467, users should update AVEVA PI Asset Framework Client to the latest version that includes security patches.

What versions of AVEVA PI Asset Framework Client are affected by CVE-2024-3467?

CVE-2024-3467 affects AVEVA PI Asset Framework Client 2018 SP3 Patch 4 and the 2023 version.

Can CVE-2024-3467 be exploited remotely?

CVE-2024-3467 requires user interaction, making it a social engineering attack that could lead to remote code execution.

What type of vulnerability is CVE-2024-3467?

CVE-2024-3467 is classified as a code execution vulnerability stemming from insecure XML handling.