OSIsoft PI Web API

An attacker with login credentials could exploit these vulnerabilities to access the PI Web API service, potentially disclose sensitive operational data stored in logs, or perform unauthorized actions on connected process historians and data sources. This could expose production setpoints, alarm thresholds, and operational metrics to unauthorized users.

Water utilities, electric utilities, and manufacturers using OSIsoft PI System for data collection and real-time monitoring should prioritize this. The PI Web API is commonly used by engineering workstations, historian servers, and plant information portals to access process data, alarm histories, and equipment status. Organizations relying on PI Web API for supervisory dashboards or mobile access to process data are directly affected.

An attacker with valid PI Web API user credentials exploits authentication and authorization weaknesses to access the web interface and trigger log disclosure or cross-site request forgery (CSRF) attacks. The attacker could trigger sensitive information to be written to application debug logs, or use CSRF to perform actions on behalf of authenticated users if CSRF defense is disabled.