All CISA Advisories, EN

AVEVA Process Optimization

View CSAF

Summary

Successful exploitation of these vulnerabilities could enable an attacker to execute remote code, perform SQL injection, escalate privileges, or access sensitive information.

The following versions of AVEVA Process Optimization are affected:

  • Process Optimization (CVE-2025-61937, CVE-2025-64691, CVE-2025-61943, CVE-2025-65118, CVE-2025-64729, CVE-2025-65117, CVE-2025-64769)
CVSS Vendor Equipment Vulnerabilities
v3 10 AVEVA AVEVA Process Optimization Improper Control of Generation of Code (‘Code Injection’), Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’), Uncontrolled Search Path Element, Missing Authorization, Use of Potentially Dangerous Function, Cleartext Transmission of Sensitive Information

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United Kingdom

Vulnerabilities

Expand All +

CVE-2025-61937

The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS System privileges of “taoimr” service, potentially resulting in complete compromise of the Model Application Server.

View CVE Details

Affected Products

AVEVA Process Optimization
Vendor:
AVEVA
Product Version:
AVEVA Process Optimization: <=2024.1
Product Status:
known_affected
Remediations

Mitigation[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.

This article has been indexed from All CISA Advisories

Read the original article: