by Kastro
Paper/Archive/CVE-2025-61937

CVE-2025-61937

AVEVA Process Optimization — AVEVA Process Optimization Code Injection

EPSS 1%CVSS 10.0
critical.is priorityof 100
45
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 73.9.739 × 2014.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the  model application server.

Affected

ProductAffectedFixed inSource
Process Optimization≤ 2024.1–CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
icscert (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refaveva.com/en/support-and-success/cyber-security-updatesrefsoftwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68earefcisa.gov/news-events/ics-advisories/icsa-26-015-01refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json