# AVEVA PI Data Archive DoS via uncaught exception

Published: 2025-06-12 · Severity: routine · Sectors: manufacturing, infrastructure
Canonical: https://vorant.io/reports/4b1d1b42-e8e7-5dab-8c14-43e574ec4865/aveva-pi-data-archive-dos-via-uncaught-exception

> Two uncaught exception flaws in AVEVA PI Data Archive allow authenticated users to trigger denial of service and data loss.

CISA has published an advisory detailing two uncaught exception vulnerabilities (CVE-2025-44019 and CVE-2025-36539) affecting AVEVA PI Data Archive and PI Server across multiple versions. Both vulnerabilities require authentication and allow a malicious or compromised user to crash necessary PI Data Archive subsystems, resulting in denial of service. CVE-2025-44019 also risks data loss in write cache and snapshots due to timing of the crash. The vulnerabilities are remotely exploitable with low attack complexity, rated CVSS 7.1 and 6.5 respectively.

Affected versions include PI Data Archive 2018 SP3 Patch 4 and prior, version 2023 and 2023 Patch 1, as well as corresponding PI Server versions. The advisory indicates no active exploitation has been reported to CISA. AVEVA recommends upgrading to PI Server 2024 or higher, or alternatively to PI Server 2018 SP3 Patch 7 or higher for legacy systems. Additional mitigations include monitoring PI Network Manager and PI Archive Subsystem service health, setting services to auto-restart, and restricting port 5450 access to trusted workstations only.

## Mentioned in this report

- Vulnerabilities: CVE-2025-36539, CVE-2025-44019

## Detection guidance (public sample)

### AVEVA PI Network Manager or Archive Subsystem Service Crash

ATT&CK: T1561

Detects unexpected termination of the PI Network Manager or PI Archive Subsystem services, the observable effect of the uncaught-exception DoS in the AVEVA PI Data Archive advisory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: AVEVA PI Network Manager or Archive Subsystem Service Crash
id: 8d2e79a1-4d92-5538-a2ef-e79e957dcc63
status: experimental
description: Detects unexpected termination of PI Network Manager or PI Archive Subsystem
  services (Service Control Manager events 7031, 7034, 7024). The uncaught-exception
  vulnerabilities CVE-2025-44019 and CVE-2025-36539 let an authenticated user crash
  these subsystems, causing denial of service and possible loss of write cache and
  snapshot data. Repeated events in a short window raise confidence.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-07
tags:
- attack.impact
- attack.t1561
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID:
    - 7031
    - 7034
    - 7024
    param1|contains:
    - PI Network Manager
    - PI Archive Subsystem
  condition: selection
falsepositives:
- Service crashes caused by faulty patching or an unrelated software bug on the PI
  server
- Unclean shutdown or host resource exhaustion on the PI server
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-07

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4b1d1b42-e8e7-5dab-8c14-43e574ec4865/aveva-pi-data-archive-dos-via-uncaught-exception.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup