High severity · published Jun 12, 2024
CVE-2024-3468
Deserialization of Untrusted Data in AVEVA PI Web API
8.4
CVSS
0.4%
EPSS
No
On KEV
Description
There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PW
PI Web API · AVEVA
through 2023 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3468
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3468
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-02
More from PI Web API
6.5
CVE-2025-2745
AVEVA PI Web API Cross-site Scripting