CVE-2020-10604: High severity osisoft pi data archive vulnerability

Published Jul 24, 2020

Updated

In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requests. This can result in blocking connections and queries to PI Data Archive.

Affected Software

20 affected components

OSIsoft PI Data Archive=2018

OSIsoft PI Data Archive=2018-sp2

OSIsoft Applications using PI Asset Framework (AF) Client versions prior to and including PI AF Client 2018 SP3 Patch 1, Version 2.10.7.283

OSIsoft Applications using PI Software Development Kit (SDK) versions prior to and including PI SDK 2018 SP1, Version 1.4.7.602

OSIsoft PI API for Windows Integrated Security versions prior to and including 2.0.2.5,

OSIsoft PI API versions prior to and including 1.6.8.26

OSIsoft PI Buffer Subsystem versions prior to and including 4.8.0.18

OSIsoft PI Connector for BACnet, versions prior to and including 1.2.0.6

OSIsoft PI Connector for CygNet, versions prior to and including 1.4.0.17

OSIsoft PI Connector for DC Systems RTscada, versions prior to and including 1.2.0.42

OSIsoft PI Connector for Ethernet/IP, versions prior to and including 1.1.0.10

OSIsoft PI Connector for HART-IP, versions prior to and including 1.3.0.1

OSIsoft PI Connector for Ping, versions prior to and including 1.0.0.54

OSIsoft PI Connector for Wonderware Historian, versions prior to and including 1.5.0.88

OSIsoft PI Connector Relay, versions prior to and including 2.5.19.0

OSIsoft PI Data Archive versions prior to and including PI Data Archive 2018 SP3, Version 3.4.430.460

OSIsoft PI Data Collection Manager, versions prior to and including 2.5.19.0

OSIsoft PI Integrator for Business Analytics versions prior to and including 2018 R2 SP1, Version 2.2.0.183

OSIsoft PI Interface Configuration Utility (ICU) versions prior to and including 1.5.0.7

OSIsoft PI to OCS versions prior to and including 1.1.36.0

Event History

Jul 24, 2020

CVE Published

via MITRE·11:34 PM

Data Sourced

via MITRE·11:34 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-20-133-02

Frequently Asked Questions

What is the severity of CVE-2020-10604?

CVE-2020-10604 is classified as a high severity vulnerability due to its ability to cause denial of service.

How do I fix CVE-2020-10604?

To fix CVE-2020-10604, upgrade to the latest versions of affected OSIsoft PI products as specified in the software vendor's release notes.

What impact does CVE-2020-10604 have on the PI Network Manager service?

CVE-2020-10604 allows a remote, unauthenticated attacker to crash the PI Network Manager service, disrupting connections and queries to the PI Data Archive.

Which OSIsoft products are affected by CVE-2020-10604?

CVE-2020-10604 affects multiple OSIsoft products including PI Data Archive, PI Asset Framework, and several PI Connectors and APIs.

Is authentication required to exploit CVE-2020-10604?

No, CVE-2020-10604 can be exploited by unauthenticated remote attackers.