CVE-2016-8365
Description
OSIsoft PI System software (Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0; Applications using PI Software Development Kit (SDK) versions prior to PI SDK 2016, Version 1.4.6; PI Buffer Subsystem, versions prior to and including, Version 4.4; and PI Data Archive versions prior to PI Data Archive 2015, Version 3.4.395.64) operates between endpoints without a complete model of endpoint features potentially causing the product to perform actions based on this incomplete model, which could result in a denial of service. OSIsoft reports that in order to exploit the vulnerability an attacker would need to be locally connected to a server. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
How to fix
- osisoft pi_af_client2.8.0 or later
- osisoft pi_buffer_subsystem4.5.0 or later
- osisoft pi_data_archive3.4.400.1162 or later
- osisoft pi_sdk1.4.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| osisoft pi_af_client | v < 2.8.0 | 2.8.0 |
| osisoft pi_buffer_subsystem | v < 4.5.0 | 4.5.0 |
| osisoft pi_data_archive | v < 3.4.400.1162 | 3.4.400.1162 |
| osisoft pi_sdk | v < 1.4.6 | 1.4.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.