CVE-2024-3467Deserialization of Untrusted Data in AVEVA PI Asset Framework Client
- 7.0HighCVSS base score
- 0.19%Exploitation in 30 daysEPSS · top 92% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privileges of an interactive user that was socially engineered to import XML supplied by an attacker.
Timeline
ID reserved
By icscert
- 2 months later
· 2 months later
Published
- 50 days later
· 50 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 4.0 | High7.0 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| NVDNVD · Modified | 4.0 | High7.0 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.19% · top 92% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.
Affected products
AVEVA · PI Asset Framework Client
- affected 2023
- affected ≤ 2018 SP3 P04
What to do
Solution: AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected products should apply security updates as soon as possible: * (Recommended) All affected versions can be fixed by upgrading to PI AF Client 2023 Patch 1 or later: From OSI Soft Customer Portal https://my.osisoft.com/ , search for "Asset Framework" and select "PI Asset Framework (AF) Client 2023 Patch 1" or later. * (Alternative) AF Client 2018 SP3 P04 and prior can be fixed by deploying PI AF Client 2018 SP3 Patch 5 or later: From OSI Soft Customer Portal https://my.osisoft.com/ , search for "Asset Framework" and select either "PI Asset Framework (AF) Client 2018 SP3 Patch 5" or later. AVEVA further recommends users follow general defensive measures: * Run PI System Explorer as a least privilege interactive account when possible. * Establish procedures for verifying the source of XML is trusted before importing into PI System Explorer. For additional information please refer to AVEVA-2024-004 https://www.aveva.com/en/support-and-success/cyber-security-updates/
References
References1
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-03 (opens in a new tab)government-resourcex_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-32053 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-3467)Record last updated .