AVEVA Enterprise SCADA Deserialization of Untrusted Data
Priority LOW 30CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps".
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00571 47th percentileScored 2026-11-07
Fix Fixed AVEVA Enterprise SCADA (AVEVA): 2025 P1, 2024 SP1 P2, 2023 SP1 P1 +2AVEVA Enterprise SCADA HMI (AVEVA): 2024 R2 HF7, 2024 P1, 2023 P2 HF1+4 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AVEVA | AVEVA Enterprise SCADA | 2025; 2024 – 2024 SP1 P01; 2023 – 2023 SP1; 2022 – 2022 SP2 P2; up to 2021 SP2 P5 | 2025 P1, 2024 SP1 P2, 2023 SP1 P1, 2022 SP2 P3, 2021 SP2 P6 | Patch available | CNA |
| AVEVA | AVEVA Enterprise SCADA HMI | 2024; up to 2023_P1; 2024 R2 | 2024 R2 HF7, 2024 P1, 2023 P2 HF1 | Patch available | CNA |
| AVEVA | AVEVA Pipeline Operations for Gas/Liquids | — | 2025 P1, 2024 SP1 P2, 2023 SP1 P1, 2022 SP2 P3, 2021 SP2 P6 | Patch available | CNA |
| AVEVA | AVEVA Pipeline Integrity Monitor (delivered on Pipeline Simulation media) | — | 2025 SP1 P2 | Patch available | CNA |
| AVEVA | AVEVA Pipeline Training Simulator (delivered on Pipeline Simulation media) | — | 2025 SP1 P2 | Patch available | CNA |
| AVEVA | Measurement Advisor | — | 2025 P1, 2021 SP1 HF16 | Patch available | CNA |
- AVEVA Enterprise SCADA VendorAVEVA Affected 2025; 2024 – 2024 SP1 P01; 2023 – 2023 SP1; 2022 – 2022 SP2 P2; up to 2021 SP2 P5 Fixed in 2025 P1, 2024 SP1 P2, 2023 SP1 P1, 2022 SP2 P3, 2021 SP2 P6 Patch available CNA
- AVEVA Enterprise SCADA HMI VendorAVEVA Affected 2024; up to 2023_P1; 2024 R2 Fixed in 2024 R2 HF7, 2024 P1, 2023 P2 HF1 Patch available CNA
- AVEVA Pipeline Operations for Gas/Liquids VendorAVEVA Affected — Fixed in 2025 P1, 2024 SP1 P2, 2023 SP1 P1, 2022 SP2 P3, 2021 SP2 P6 Patch available CNA
- AVEVA Pipeline Integrity Monitor (delivered on Pipeline Simulation media) VendorAVEVA Affected — Fixed in 2025 SP1 P2 Patch available CNA
- AVEVA Pipeline Training Simulator (delivered on Pipeline Simulation media) VendorAVEVA Affected — Fixed in 2025 SP1 P2 Patch available CNA
- Measurement Advisor VendorAVEVA Affected — Fixed in 2025 P1, 2021 SP1 HF16 Patch available CNA
Remediation
- Fix · CNA AVEVA Enterprise SCADA (AVEVA) Fixed in 2025 P1, 2024 SP1 P2, 2023 SP1 P1, 2022 SP2 P3, 2021 SP2 P6
- Fix · CNA AVEVA Enterprise SCADA HMI (AVEVA) Fixed in 2024 R2 HF7, 2024 P1, 2023 P2 HF1
- Fix · CNA AVEVA Pipeline Operations for Gas/Liquids (AVEVA) Fixed in 2025 P1, 2024 SP1 P2, 2023 SP1 P1, 2022 SP2 P3, 2021 SP2 P6
- Fix · CNA AVEVA Pipeline Integrity Monitor (delivered on Pipeline Simulation media) (AVEVA) Fixed in 2025 SP1 P2
- Fix · CNA AVEVA Pipeline Training Simulator (delivered on Pipeline Simulation media) (AVEVA) Fixed in 2025 SP1 P2
- Fix · CNA Measurement Advisor (AVEVA) Fixed in 2025 P1, 2021 SP1 HF16
Timeline
- 2026-10-02 Threatist record created from CVE-2025-7639
- 2026-10-03 Alias added: GHSA-4m9v-7gg3-m6j6
References
More AVEVA vulnerabilities
- TI-2022-07857 Path traversal in AVEVA InTouch Access Anywhere CVSS 3.1HIGH 7.5
- TI-2019-04597 Missing authentication in ICS-CERT AVEVA Software, LLC InduSoft Web Studio prior to… CVSS 3.1CRITICAL 9.8
- TI-2022-11329 Deserialization of untrusted data in AVEVA Edge CVSS 3.1HIGH 7.8
- TI-2011-02773 Use-after-free vulnerability in Control Microsystems ClearSCADA 2005, 2007, and 2009… CVSS 2.0HIGH 10.0
- TI-2025-38285 AVEVA Process Optimization Code Injection CVSS 4.0CRITICAL 10.0
- TI-2021-18992 An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio)… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-7639 · CVE Program
- CVE-2025-7639 · NVD
- FIRST EPSS
- GHSA-4m9v-7gg3-m6j6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences