CVE-2016-8365 - CVE House
Back to Database
Status published Medium CVE-2016-8365

OSIsoft PI System software (Applications using PI Asset Framework (AF)...

Vulnerability Description

OSIsoft PI System software (Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0; Applications using PI Software Development Kit (SDK) versions prior to PI SDK 2016, Version 1.4.6; PI Buffer Subsystem, versions prior to and including, Version 4.4; and PI Data Archive versions prior to PI Data Archive 2015, Version 3.4.395.64) operates between endpoints without a complete model of endpoint features potentially causing the product to perform actions based on this incomplete model, which could result in a denial of service. OSIsoft reports that in order to exploit the vulnerability an attacker would need to be locally connected to a server. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-8365

Credits & Attribution

No credits recorded in the NVD database.

References

More from OSIsoft

View All →
CVE-2021-43553
OSIsoft PI Vision
Low 3.1
CVE-2021-43551
OSIsoft PI Vision
Medium 6.5
CVE-2021-43549
OSIsoft PI Web API
Medium 6.9
CVE-2020-25167
OSIsoft PI Vision Incorrect Authorization
Medium 4.9
CVE-2020-25163
OSIsoft PI Vision Cross-site Scripting
High 7.7

Affected Vendor

Affected Software

PI System software
Vulnerable Versions:
Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0, Applications using PI Software Development Kit (SDK) versions prior to PI SDK 2016, Version 1.4.6, PI Buffer Subsystem, versions prior to and including, Version 4.4, PI Data Archive versions prior to PI Data Archive 2015, Version 3.4.395.64.

Timeline

Official Publish: April 3rd, 2018
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-437

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.