CVE-2023-34348 lets an unauthenticated user remotely crash the PI Message Subsystem of AVEVA PI Server, scored 7.5 High. It affects PI Server 2023 and 2018 SP3 Patch 5 and earlier. The fix is PI Server 2023 Patch 1 or later, or 2018 SP3 Patch 6 or later.
What's affected
Per CISA advisory ICSA-24-018-01, the affected versions are AVEVA PI Server 2023 and PI Server 2018 SP3 P05 and earlier. The fixed versions are PI Server 2023 Patch 1 or later, and, for the 2018 line, 2018 SP3 Patch 6 or later. Downloads are on the OSI Soft customer portal.
The impact is a denial of service in the PI Message Subsystem. CISA and the record both score it 7.5 High, so there is no severity conflict. The vector shows no effect on confidentiality or integrity, only availability.
How to check if you're exposed
Open the PI Server version information on each server, for example in the PI System Management Tools, and compare it to the patch levels above. Anything on 2023 without Patch 1, or on 2018 SP3 at Patch 5 or lower, is affected.
Then check who can reach the service. CISA's advisory names port 5450 as the one to restrict. From a machine that should not have access, see whether the port answers. Any path from the corporate network or beyond should be reviewed.
What to do now
- Install PI Server 2023 Patch 1 or later, or 2018 SP3 Patch 6 or later, from the customer portal.
- Configure the PI Message Subsystem to restart automatically.
- Monitor the subsystem's memory use.
- Restrict network access to port 5450 to trusted workstations and software.
- Limit write access to the PI Server Message Log through the PIMSGSS entry in the Database Security plugin.
- Keep control system devices off the internet, behind firewalls, and use updated VPNs for remote access.
Why it matters
In plain terms, the service does not cope with certain unexpected input and stops. An unauthenticated network request is enough, which is why the score is high even though nothing is stolen.
PI Server collects process data for plants and utilities. A crashed message subsystem may blind operators to logs and events at a bad time. This is why availability bugs in industrial software deserve the same attention as ones that leak data.
The weakness classes involved are CWE-703 (Improper Check or Handling of Exceptional Conditions), CWE-755 (Improper Handling of Exceptional Conditions), CWE-754 (Improper Check for Unusual or Exceptional Conditions). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
CISA and the record agree on 7.5 High. The advisory gives mitigations along with the patch levels.
Try it yourself
Advisories like this one reach you through several channels. This demo shows how a watch on your own inventory turns a new CVE into a short list of affected systems.
Click through it at your own pace, or open it full screen.
Quick check
Can this be exploited without credentials?
Yes. The record and CISA both describe it as unauthenticated and remote, and the effect is a crash of the PI Message Subsystem.
What if I cannot patch yet?
Restrict port 5450, enable automatic restart, monitor memory use and keep the system off the internet, as CISA lists.
Sources
Last reviewed: 19 October 2026.
