CVE-2025-61937criticalCWE-94

CVE-2025-61937: critical vulnerability in AVEVA Process Optimization

AVEVA Process Optimization Code Injection

Published

Follow this CVE+ Monitor Process Optimization

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 1.5%
The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the  model application server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
AVEVA · Process Optimization
Related CVEs — AVEVA Process Optimization

In the same product, most dangerous first.

CVE-2025-61943CRITICALAVEVA Process Optimization SQL InjectionEPSS 0.3%CVE-2025-64691CRITICALAVEVA Process Optimization Code InjectionEPSS 0.3%CVE-2025-65118CRITICALAVEVA Process Optimization Uncontrolled Search Path ElementEPSS 0.3%CVE-2025-65117HIGHAVEVA Process Optimization Use of Potentially Dangerous FunctionEPSS 0.2%CVE-2025-64729HIGHAVEVA Process Optimization Missing AuthorizationEPSS 0.2%CVE-2025-64769HIGHAVEVA Process Optimization Cleartext Transmission of Sensitive InformationEPSS 0.2%