PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-31274 Rockwell Automation CVE debrief

CVE-2023-31274 is a high-severity vulnerability in Rockwell Automation FactoryTalk Historian SE, published on 2024-05-09. The product incorporates the AVEVA PI Server, which contains a memory exhaustion flaw in its PI Message Subsystem. An unauthenticated remote attacker can exploit this vulnerability to trigger a partial denial-of-service condition by consuming available memory. Successful exploitation renders FactoryTalk Historian SE unavailable and requires a physical power cycle to restore operation. The vulnerability affects FactoryTalk Historian SE versions 9.0 and earlier. Rockwell Automation has released version 9.01 or higher to address this issue.

Vendor
Rockwell Automation
Product
FactoryTalk Historian SE
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2024-01-18
Original CVE updated
2024-01-18
Advisory published
2024-01-18
Advisory updated
2024-01-18

Who should care

Organizations operating Rockwell Automation FactoryTalk Historian SE in industrial control system environments, particularly those with externally accessible or poorly segmented PI Server deployments. Critical infrastructure operators in manufacturing, energy, and process industries relying on historian data availability for operational decision-making.

Technical summary

The vulnerability exists in the AVEVA PI Server component used by FactoryTalk Historian SE. The PI Message Subsystem does not properly constrain memory allocation from unauthenticated network sources, allowing an attacker to exhaust available system memory. This results in a partial denial-of-service condition that requires a power cycle to recover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates network accessibility with low attack complexity, no privileges required, and high availability impact.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade FactoryTalk Historian SE to version 9.01 or higher as soon as feasible
  • Apply network segmentation to limit exposure of PI Server components
  • Monitor PI Message Subsystem memory utilization for anomalous consumption patterns
  • Implement defense-in-depth controls per CISA ICS recommended practices
  • Review AVEVA security bulletins AVEVA-2024-001 and AVEVA-2024-002 for additional product guidance

Evidence notes

Vulnerability disclosed via CISA ICS Advisory ICSA-24-130-01 on 2024-05-09. Affects FactoryTalk Historian SE ≤v9.0. Root cause is memory exhaustion in AVEVA PI Server's PI Message Subsystem. Vendor fix available in version 9.01 or higher.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-31274 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-31274

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-31274 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-31274

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-130-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-130-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.