CVE-2025-65118
BaseFortify
Publication date: 2026-01-16
Last updated on: 2026-01-16
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| aveva | pi_integrator_for_business_analytics | 2020_r2_sp1 |
| aveva | pi_web_api | * |
| aveva | pi_connector_for_cygnet | * |
| aveva | pi_data_archive | * |
| aveva | suitelink_server | * |
| aveva | historian_server | * |
| aveva | pi_af_client | * |
| aveva | edge | * |
| aveva | pi_server | * |
| aveva | operations_control_logger | * |
| aveva | plant_scada | * |
| aveva | telemetry_server | * |
| aveva | intouch_access_anywhere | * |
| aveva | system_platform | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-427 | The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows an authenticated user with standard OS privileges to trick Process Optimization services into loading arbitrary code. This can lead to privilege escalation from a standard user to OS System level, potentially resulting in complete compromise of the Model Application Server.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to an attacker gaining full control over the Model Application Server by escalating their privileges to OS System level. This could result in unauthorized code execution, data compromise, and disruption of services.
What immediate steps should I take to mitigate this vulnerability?
Apply the latest security updates and patches provided by AVEVA for the affected products to mitigate this vulnerability. Ensure that all AVEVA software components such as PI Integrator for Business Analytics, PI Web API, PI Connector for CygNet, PI Data Archive, SuiteLink Server, Historian Server, PI AF Client, AVEVA Edge, AVEVA PI Server, Operations Control Logger, Plant SCADA, Telemetry Server, InTouch Access Anywhere, and System Platform are updated to the latest secure versions as per AVEVA's cyber security updates. [1]