An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services…

Published 9 y ago 2017-02-13 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.4%

percentile 32%

Public exploits

none known

An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords to become exposed for the affected services, potentially leading to unauthorized shutdown of the affected PI services as well as potential reuse of domain credentials.

Exploit prediction (EPSS)

0.37% probability of exploitation in the next 30 days, higher than 32% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.8	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	2.1	`AV:L/AC:L/Au:N/C:P/I:N/A:N`

Affected products

n/a OSIsoft PI Coresight and PI Web API

Classification

Weakness

CWE-532 Insertion of Sensitive Information into Log File

References

securityfocus.com /bid/95355 · vdb-entry, x_refsource_BID, x_transferred
ics-cert.us-cert.gov /advisories/ICSA-17-010-01 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2017-5153
NVD: CVE-2017-5153

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.