What’s Vulnerable › Vulnerabilities

CVE-2024-3467: Deserialization of Untrusted Data in AVEVA PI Asset Framework Client

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-12 · updated 2026-06-17
• Weakness: CWE-502

Description

There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privileges of an interactive user that was socially engineered to import XML supplied by an attacker.

Affected products

• AVEVA PI Asset Framework Client: 2018-sp3_patch_4, 2023

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-03
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-03

Get alerted when CVE-2024-3467 or the next vulnerability affects your stack