CVE-2016-8365

lowPriorität · verfolgen · 22EPSS 0.003 · 28. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.35% (28th) EPSS

CVSS 2.1 · low

Is it mine?

16 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-27

OSIsoft PI System software (Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0; Applications using PI Software Development Kit (SDK) versions prior to PI SDK 2016, Version 1.4.6; PI Buffer Subsystem, versions prior to and including, Version 4.4; and PI Data Archive versions prior to PI Data Archive 2015, Version 3.4.395.64) operates between endpoints without a complete model of endpoint features potentially causing the product to perform actions based on this incomplete model, which could result in a denial of service. OSIsoft reports that in order to exploit the vulnerability an attacker would need to be locally connected to a server. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

MitigationApplications using PI Asset Framework (AF) Client 2016cisa_csaf_ot
In order to perform the upgrades, users can use the PI AF Client 2016 Install Kit to upgrade PI AF Client and the PI Buffer Subsystem together. Users can use the PI SDK 2016 Install Kit to upgrade the PI SDK. If PI Buffer Subsystem is installed on a machine without PI AF Client, users can use the PI Interface Configuration Utility (ICU) Install Kit (1.4.16.79B) to upgrade buffering without installing the PI AF Client software.
MitigationApplications using PI Software Development Kit (SDK) 2016cisa_csaf_ot
In order to perform the upgrades, users can use the PI AF Client 2016 Install Kit to upgrade PI AF Client and the PI Buffer Subsystem together. Users can use the PI SDK 2016 Install Kit to upgrade the PI SDK. If PI Buffer Subsystem is installed on a machine without PI AF Client, users can use the PI Interface Configuration Utility (ICU) Install Kit (1.4.16.79B) to upgrade buffering without installing the PI AF Client software.
MitigationPI Buffer Subsystemcisa_csaf_ot
In order to perform the upgrades, users can use the PI AF Client 2016 Install Kit to upgrade PI AF Client and the PI Buffer Subsystem together. Users can use the PI SDK 2016 Install Kit to upgrade the PI SDK. If PI Buffer Subsystem is installed on a machine without PI AF Client, users can use the PI Interface Configuration Utility (ICU) Install Kit (1.4.16.79B) to upgrade buffering without installing the PI AF Client software.
MitigationPI Data Archive 2105cisa_csaf_ot
In order to perform the upgrades, users can use the PI AF Client 2016 Install Kit to upgrade PI AF Client and the PI Buffer Subsystem together. Users can use the PI SDK 2016 Install Kit to upgrade the PI SDK. If PI Buffer Subsystem is installed on a machine without PI AF Client, users can use the PI Interface Configuration Utility (ICU) Install Kit (1.4.16.79B) to upgrade buffering without installing the PI AF Client software.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 2.1–7.1

v2.02.1lowAV:L/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 2.9

v3.05.5mediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 3.6

v3.07.1highCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · CISA US

v3.05.1mediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-284USprimärCWE-437USCWE-437US

betroffene Produkte (16)

Betroffene Produkte und Versionsbereiche.

OSIsoft Applications using PI Asset Framework (AF) Client 2016: <2.8.0alle Versionencisa_csaf_otUS
OSIsoft Applications using PI Software Development Kit (SDK) 2016: <1.4.6alle Versionencisa_csaf_otUS
OSIsoft PI Buffer Subsystem: <=4.4alle Versionencisa_csaf_otUS
OSIsoft PI Data Archive 2105: <3.4.395.64alle Versionencisa_csaf_otUS
OSIsoft Applications using PI Asset Framework (AF) Client 2016< 2.8.0cisa_csaf_otUS
OSIsoft Applications using PI Software Development Kit (SDK) 2016< 1.4.6cisa_csaf_otUS
OSIsoft PI Buffer Subsystem≤ 4.4cisa_csaf_otUS
OSIsoft PI Data Archive 2105< 3.4.395.64cisa_csaf_otUS
OSIsoft PI System software≤ Applications using PI Software Development Kit (SDK) versions prior to PI SDK 2016, Version 1.4.6enisa_euvdEU
OSIsoft PI System software≤ PI Data Archive versions prior to PI Data Archive 2015, Version 3.4.395.64.enisa_euvdEU
OSIsoft PI System software≤ Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0enisa_euvdEU
OSIsoft PI System software≤ PI Buffer Subsystem, versions prior to and including, Version 4.4enisa_euvdEU
osisoft pi af client< 2.8.0nvdUScpe:2.3:a:osisoft:pi_af_client:*:*:*:*:*:*:*:*
osisoft pi buffer subsystem< 4.5.0nvdUScpe:2.3:a:osisoft:pi_buffer_subsystem:*:*:*:*:*:*:*:*
osisoft pi data archive< 3.4.400.1162nvdUScpe:2.3:a:osisoft:pi_data_archive:*:*:*:*:*:*:*:*
osisoft pi sdk< 1.4.6nvdUScpe:2.3:a:osisoft:pi_sdk:*:*:*:*:*:*:*:*

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-16-313-03OSIsoft PI System Incomplete Model of Endpoint Features Vulnerability2016-08-12icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot nvd NVD CVE.org MITRE

veröffentlicht 2018-04-03geändert 2026-06-17

verwandt (13,840)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-81963US	high7.8OT kritisch	0.39% (33rd)	KEV	2026-09-08
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
CVE-2026-56290US	critical9.8OT kritisch	30.9% (98th)	KEV	2026-06-29
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitra…
CVE-2026-49049US	—OT kritisch	0.99% (62nd)	Exploit	2026-06-29
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameter…
CVE-2026-48907US	critical9.8OT kritisch	85.4% (100th)	KEV	2026-06-05
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
CVE-2026-34908US	—OT kritisch	88.3% (100th)	KEV	2026-05-22
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

+13835 weitere

Referenzen (9)

Externe Belege — Patches, Meldungen, Analysen.

https://ics-cert.us-cert.gov/advisories/ICS-VU-313-03 cnnvd
https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00308 cnnvd
https://www.securityfocus.com/bid/94165 cnnvd
http://www.securityfocus.com/bid/94165 enisa_euvd
https://ics-cert.us-cert.gov/advisories/ICS-VU-313-03 enisa_euvd
https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00308 enisa_euvd
http://www.securityfocus.com/bid/94165Third Party AdvisoryVDB Entrynvd
https://ics-cert.us-cert.gov/advisories/ICS-VU-313-03Third Party AdvisoryUS Government Resourcenvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan