Published Date: May 9, 2024
Last updated: May 9, 2024
Revision Number: 1.0
CVSS Score: v3.1: 7.5/10, v4.0: 7.7/10
AFFECTED PRODUCTS AND SOLUTION
Affected Product
|
Affected Versions
|
Corrected in software version
|
FactoryTalk® Historian SE
|
< v9.0
|
v9.01 and later
|
VULNERABILITY DETAILS
Rockwell Automation used version 3.1 and 4.0 of the CVSS scoring system to assess the following vulnerabilities.
CVE-2023-31274 IMPACT
FactoryTalk® Historian SE utilizes the AVEVA PI Server, which contains a vulnerability, which could allow an unauthenticated user to cause a partial denial-of-service condition in the PI Message Subsystem of a PI Server by consuming available memory. This vulnerability exists in FactoryTalk® Historian SE versions 9.0 and earlier. Exploitation of this vulnerability could cause FactoryTalk® Historian SE to become unavailable, requiring a power cycle to recover it.
CVSS Base Score v3.1: 7.5/10
CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Base Score v4.0: 7.7/10
CVSS Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
CWE: Dependency on Vulnerable third-party Component
CVE-2023-34348 IMPACT
FactoryTalk® Historian SE use the AVEVA PI Server, which contains a vulnerability that could allow an unauthenticated user to remotely crash the PI Message Subsystem of a PI Server, resulting in a denial-of-service condition. This vulnerability exists in FactoryTalk® Historian SE versions 9.0 and earlier. Exploitation of this vulnerability could cause FactoryTalk® Historian SE to become unavailable, requiring a power cycle to recover it.
CVSS Base Score v3.1: 7.5/10
CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Base Score v4.0: 7.7/10
CVSS Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
CWE: Dependency on Vulnerable third-party Component
Known Exploited Vulnerability (KEV) database: No
Users can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization.
Mitigations and Workarounds
Users using the affected software are encouraged to install FactoryTalk® Historian SE version 9.01 or higher as soon as feasible. For customers unable to upgrade to v9.0, defensive measures are available in the Rockwell article.
Additionally, we encourage customers to implement our suggested security best practices to minimize the risk of vulnerability.
ADDITIONAL RESOURCES
