CVE-2025-44019: AVEVA PI Data Archive DoS Vulnerability

CVE-2025-44019 Overview

CVE-2025-44019 affects AVEVA PI Data Archive products with an uncaught exception flaw [CWE-248]. An authenticated user can trigger the exception to shut down required PI Data Archive subsystems, causing a denial of service condition. Depending on when the crash occurs, data held in snapshots or the write cache may be lost.

The vulnerability is network-exploitable and requires only low-privilege authentication. It carries a CVSS 4.0 base score of 7.1 (HIGH). PI Data Archive is a core historian component in industrial control system (ICS) environments, making availability a critical operational concern.

Critical Impact
Authenticated network attackers can crash PI Data Archive subsystems, disrupting industrial historian operations and causing loss of unwritten snapshot and cache data.

Affected Products

AVEVA PI Data Archive (see CISA ICS Advisory ICSA-25-162-07 for version details)
Deployments using PI Data Archive subsystems exposed to authenticated PI System users
Industrial environments relying on PI Data Archive for time-series historian data

Discovery Timeline

2025-06-12 - CVE-2025-44019 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-44019

Vulnerability Analysis

The vulnerability is classified under [CWE-248] Uncaught Exception. AVEVA PI Data Archive subsystems fail to catch an exception condition that an authenticated user can trigger through normal network-reachable interfaces. When the exception propagates without handling, the affected subsystem terminates, removing functionality required for the historian to operate.

The immediate result is a denial of service against the PI Data Archive. In ICS and operational technology (OT) environments, this disrupts time-series data collection, archival, and downstream analytics that depend on PI subsystems. Data in volatile state — specifically snapshots and the write cache that have not yet been flushed to persistent archives — can be lost if the crash occurs before scheduled persistence.

The attack requires valid authentication credentials but no user interaction. Confidentiality and integrity of stored data are not directly affected by the flaw itself, though the loss of in-memory snapshot data has indirect integrity implications for downstream consumers.

Root Cause

The defect originates from missing exception handling around input or state conditions reachable by authenticated PI users. The subsystem does not validate or guard the operation that produces the unhandled exception, allowing a single malformed or unexpected request to terminate the process.

Attack Vector

An attacker with valid PI System credentials sends a crafted request over the network to a vulnerable PI Data Archive subsystem. The request causes the subsystem to encounter an unhandled exception and exit. Repeated invocation extends the outage and increases the probability of write-cache data loss.

No verified public proof-of-concept is available. Refer to the AVEVA Cyber Security Updates portal and CISA ICS Advisory ICSA-25-162-07 for vendor-supplied technical details.

Detection Methods for CVE-2025-44019

Indicators of Compromise

Unexpected termination or restart events for PI Data Archive subsystem processes on historian hosts.
Gaps in time-series data archives correlating with subsystem crash timestamps.
Authenticated PI client sessions immediately preceding subsystem shutdown in PI message logs.

Detection Strategies

Monitor PI Data Archive message logs (pimsgss) for unhandled exception entries and abnormal subsystem exit codes.
Correlate Windows Service Control Manager events for PI subsystem stop or crash events with authenticated network sessions on PI ports.
Baseline normal PI client request patterns and alert on anomalous request volumes from individual authenticated accounts.

Monitoring Recommendations

Forward PI Data Archive logs and Windows event logs to a centralized SIEM with retention adequate for ICS incident analysis.
Track snapshot and write-cache flush metrics to detect data loss windows.
Enable continuous availability monitoring for PI subsystems with alerting on unplanned restarts.

How to Mitigate CVE-2025-44019

Immediate Actions Required

Inventory all AVEVA PI Data Archive deployments and identify versions affected per CISA ICS Advisory ICSA-25-162-07.
Apply AVEVA-supplied security updates available through the OSIsoft Resource Portal.
Restrict network access to PI Data Archive ports to known PI client hosts using host and network firewalls.
Review and minimize PI user account privileges; remove or disable unused accounts.

Patch Information

AVEVA has issued guidance and updates for affected PI Data Archive versions. Download patches from the OSIsoft Resource Portal and review remediation steps on the AVEVA Cyber Security Updates page. Follow the version mapping and upgrade procedure documented in CISA ICS Advisory ICSA-25-162-07.

Workarounds

Place PI Data Archive servers behind ICS-aware network segmentation and deny direct access from enterprise or untrusted networks.
Enforce strong authentication and audit PI Identity, PI Mapping, and PI Trust configurations to limit who can connect.
Configure PI subsystem auto-restart and reduce snapshot flush intervals to limit data loss exposure during a crash.
Monitor and rate-limit PI client connections from individual accounts where supported.

bash

# Configuration example - restrict inbound access to PI Data Archive (TCP 5450)
# Windows Firewall rule scoping to a known PI client subnet
netsh advfirewall firewall add rule name="PI Data Archive - PI Clients Only" \
  dir=in action=allow protocol=TCP localport=5450 \
  remoteip=10.20.30.0/24 profile=domain,private