PatchSiren cyber security CVE debrief

CVE-2024-7113 AVEVA CVE debrief

CVE-2024-7113 is a HIGH severity vulnerability (CVSS 7.5) in AVEVA SuiteLink Server, published on 2024-08-13. If exploited, this vulnerability could cause a SuiteLink server to consume excessive system resources and slow down processing of Data I/O for the duration of the attack. The vulnerability affects multiple AVEVA products including SuiteLink (≤3.7.0), Historian (≤2023_R2_P01), InTouch (≤2023_R2_P01), Application Server (≤2023_R2_P01), Communication Drivers Pack (≤2023_R2), and Batch Management (≤2023). AVEVA has released SuiteLink v3.7.100 to address this issue. CISA published advisory ICSA-24-226-01 on 2024-08-13 with coordinated disclosure.

Vendor: AVEVA
Product: SuiteLink
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-08-13
Original CVE updated: 2024-08-13
Advisory published: 2024-08-13
Advisory updated: 2024-08-13

Who should care

Organizations running AVEVA SuiteLink Server or dependent products (Historian, InTouch, Application Server, Communication Drivers Pack, Batch Management) in industrial control system environments. Critical infrastructure operators, manufacturing facilities, and process control environments where SuiteLink is deployed for real-time data communication should prioritize patching due to the potential for operational disruption from resource exhaustion attacks.

Technical summary

CVE-2024-7113 is a network-accessible vulnerability in AVEVA SuiteLink Server that can be exploited to cause excessive system resource consumption, resulting in degraded Data I/O processing performance. The vulnerability has a CVSS 3.1 score of 7.5 (HIGH) with attack vector NETWORK, attack complexity LOW, and no privileges required. The confidentiality and integrity impacts are NONE, with HIGH availability impact. The vulnerability affects SuiteLink Server and multiple dependent AVEVA products that incorporate the SuiteLink component. Remediation requires upgrading to SuiteLink v3.7.100. Network segmentation and firewall restrictions to limit access to trusted sources on port 5413 are recommended compensating controls.

Defensive priority

HIGH

Recommended defensive actions

Upgrade to SuiteLink v3.7.100 to remediate this vulnerability in affected products.
Apply host and/or network firewall rules restricting the SuiteLink server to accept traffic only from trusted sources; SuiteLink listens on port 5413 by default.
Evaluate the impact of this vulnerability based on your operational environment, architecture, and product implementation.
Review AVEVA Security Bulletin AVEVA-2024-007 for additional guidance.
Follow CISA ICS recommended practices for defense-in-depth strategies in industrial control systems.

Evidence notes

CVE published 2024-08-13; CISA advisory ICSA-24-226-01 published same date. CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Affected products confirmed via CSAF product tree with 6 product IDs.

Official resources

Coordinated disclosure via CISA ICS advisory ICSA-24-226-01 on 2024-08-13.