CVE-2025-61937

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-61937
The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the  model application server.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json Third Party Advisory
https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea Permissions Required
https://www.aveva.com/en/support-and-success/cyber-security-updates/ Vendor Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:aveva:process_optimization:*:*:*:*:*:*:*:*
History

17 Jun 2026, 09:51

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad, si se explota, podría permitir a un atacante no autenticado lograr la ejecución remota de código bajo los privilegios de sistema operativo del servicio 'taoimr', lo que podría resultar en el compromiso completo del servidor de aplicaciones del modelo.

22 Jan 2026, 15:20

Type Values Removed Values Added
References () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json - () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json - Third Party Advisory
References () https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea - () https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea - Permissions Required
References () https://www.aveva.com/en/support-and-success/cyber-security-updates/ - () https://www.aveva.com/en/support-and-success/cyber-security-updates/ - Vendor Advisory
References () https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01 - () https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01 - Third Party Advisory, US Government Resource
CPE cpe:2.3:a:aveva:process_optimization:*:*:*:*:*:*:*:*
First Time Aveva process Optimization
Aveva

16 Jan 2026, 02:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-16 02:16

Updated : 2026-06-17 09:51

NVD link : CVE-2025-61937

Mitre link : CVE-2025-61937

CVE.ORG link : CVE-2025-61937

JSON object : View

Products Affected

aveva

  • process_optimization
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')