CVE-2023-34348

highPriorität · verfolgen · 30EPSS 0.006 · 46. PerzentilDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.56% (46th) EPSS

CVSS 7.5 · high

Is it mine?

11 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to remotely crash the PI Message Subsystem of a PI Server, resulting in a denial-of-service condition.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenPI Servercisa_csaf_ot
All affected versions can be fixed by upgrading to AVEVA PI Server version 2023 Patch 1 or later. From OSI Soft Customer Portal, search for "PI Server" and select version "2023 Patch 1".
https://my.osisoft.com/
BehobenFactoryTalk Historian SEcisa_csaf_ot
FactoryTalk Historian SE: Users using the affected software are encouraged to install FactoryTalk Historian SE version 9.01 or higher as soon as feasible.
MitigationPI Servercisa_csaf_ot
AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected products should apply security updates as soon as possible.
MitigationFactoryTalk Historian SEcisa_csaf_ot
Rockwell Automation has released product updates addressing this vulnerability:

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ics-cert@hq.dhs.gov USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-755USprimärCWE-703USCWE-703USCWE-703USCWE-754US

betroffene Produkte (11)

Betroffene Produkte und Versionsbereiche.

Rockwell Automation FactoryTalk Historian SE: <=v9.0alle Versionencisa_csaf_otUS
AVEVA PI Serveralle Versionencisa_csaf_otUS
AVEVA PI Server≤ 2018_SP3_P05cisa_csaf_otUS
Rockwell Automation FactoryTalk Historian SE≤ v9.0cisa_csaf_otUS
PI Server≤ 2023enisa_euvdEU
PI Server≤ 0 ≤2018 SP3 P05enisa_euvdEU
AVEVA Software, LLC PI Server≤ 2018 SP3 P05fstec_bduRU
AVEVA Software, LLC PI Server≤ 2023fstec_bduRU
aveva pi server< 2018nvdUScpe:2.3:a:aveva:pi_server:*:*:*:*:*:*:*:*
aveva pi server= 2018nvdUScpe:2.3:a:aveva:pi_server:*:*:*:*:*:*:*:*
aveva pi server= 2023nvdUScpe:2.3:a:aveva:pi_server:*:*:*:*:*:*:*:*

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2024-1087Rockwell Automation FactoryTalk Historian SE: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-05-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Rockwell Automation FactoryTalk Historian SE ausnutzen, um einen Denial of Service Angriff durchzuführen.
ICSA-24-018-01AVEVA PI Server2024-01-18icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to crash the product being accessed or throttle the memory leading to a partial denial-of-service condition.
ICSA-24-130-01Rockwell Automation FactoryTalk Historian SE2024-05-09icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd cert_bund NVD CVE.org MITRE

veröffentlicht 2024-01-18geändert 2026-06-17

verwandt (705)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-109619US	high8.1OT kritisch	100.0% (100th)	KEV	2026-10-21
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The g…
CVE-2026-109618US	critical9.8OT kritisch	100.0% (100th)	KEV	2026-10-21
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave…
CVE-2024-29748US	high7.8OT kritisch	0.68% (52nd)	KEV	2024-04-05
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti…
CVE-2022-22265US	high7.8OT kritisch	0.39% (33rd)	KEV	2022-01-10
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
CVE-2021-38003US	high8.8OT kritisch	38.6% (99th)	KEV	2021-11-23
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

+700 weitere

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

https://cxsecurity.com/cveshow/CVE-2023-34348/cnnvd
https://softwaresupport.aveva.com/Patchcnnvd
https://www.auscert.org.au/bulletins/ESB-2024.0385 cnnvd
https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01 cnnvd
https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01 enisa_euvd
https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01MitigationThird Party AdvisoryUS Government Resourcenvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan