CVE-2024-3468 HIGH

CVE-2024-3468: Deserialization of Untrusted Data in AVEVA PI Web API

Vendor Aveva

Product PI Web API

Weakness CWE-502 · Unsafe deserialization

Published June 12, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

8.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.

Key dates

02Disclosure timeline

June 12, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-3468 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html

Related vulnerabilities

04Related CVE

CVE-2025-40553 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2023-36039 Microsoft Exchange Server Spoofing Vulnerability CVE-2025-67997 WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability CVE-2025-65035 GLPI Database Inventory Plugin Vulnerable to Stored Object Injection CVE-2026-3967 Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization