Read the docs
TI-2020-08512 Aliases CVE-2020-10600GHSA-3h4f-76g6-g5wc

OSIsoft PI System

Priority LOW 34CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-476.

Summary

An authenticated remote attacker could crash PI Archive Subsystem when the subsystem is working under memory pressure. This can result in blocking queries to PI Data Archive (2018 SP2 and prior versions).

Why it matters now

EPSS 0.01201 68th percentileScored 2026-11-07
Fix Fixed PI Data Archive (OSIsoft): 2018 SP2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OSIsoftPI Data Archivebefore 2018 SP22018 SP2Patch availableCNA
  • PI Data Archive VendorOSIsoft Affected before 2018 SP2 Fixed in 2018 SP2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:osisoft:pi_data_archive:*:*:*:*:*:*:*:*up to 2019VulnerableOSIsoft
  • cpe:2.3:a:osisoft:pi_data_archive:*:*:*:*:*:*:*:* Versions up to 2019 Vulnerable ·OSIsoft

Remediation

  • Fix · CNA PI Data Archive (OSIsoft) Fixed in 2018 SP2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10600
  2. 2026-10-03 Alias added: GHSA-3h4f-76g6-g5wc

References

Advisory 1

  • TI-2020-08516 Improper handling of exceptional conditions in OSIsoft PI System multiple products and… CVSS 3.1HIGH 7.5
  • TI-2018-05438 Deserialization of untrusted data in OSIsoft PI Data Archive CVSS 3.0HIGH 7.5
  • TI-2017-05539 Improper authentication in OSIsoft PI Server 2017 CVSS 3.0HIGH 7.4
  • TI-2020-08522 Uncontrolled search path in OSIsoft PI System multiple products and versions CVSS 3.1HIGH 7.8
  • TI-2020-08520 Improper signature verification in OSIsoft PI System multiple products and versions CVSS 3.1HIGH 7.8
  • TI-2020-08518 Incorrect default permissions in OSIsoft PI System multiple products and versions CVSS 3.1HIGH 7.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences