by Kastro
Paper/Archive/CVE-2025-64691

CVE-2025-64691

AVEVA Process Optimization — AVEVA Process Optimization Code Injection

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
32
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 21.4.214 × 204.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS system, potentially resulting in complete compromise of the model application server.

Affected

ProductAffectedFixed inSource
Process Optimization≤ 2024.1–CNA

Scores by source

icscert (CNA)9.3CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
icscert (CNA)8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refaveva.com/en/support-and-success/cyber-security-updatesrefsoftwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68earefcisa.gov/news-events/ics-advisories/icsa-26-015-01refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json