Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2025-7639

AVEVA Enterprise SCADA Deserialization of Untrusted Data

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps".

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AVEVA AVEVA Enterprise SCADA

Default version status: unaffected

  • 2025affected
  • 2024 to ≤ 2024 SP1 P01affected
  • 2023 to ≤ 2023 SP1affected
  • 2022 to ≤ 2022 SP2 P2affected
  • 0 to ≤ 2021 SP2 P5affected
  • 2025 P1unaffected
  • 2024 SP1 P2unaffected
  • 2023 SP1 P1unaffected
  • 2022 SP2 P3unaffected
  • 2021 SP2 P6unaffected

AVEVA AVEVA Enterprise SCADA HMI

Default version status: unaffected

  • 2024affected
  • 0 to ≤ 2023_P1affected
  • 2024 R2affected
  • 2024 R2 HF7unaffected
  • 2024 P1unaffected
  • 2023 P2 HF1unaffected

AVEVA AVEVA Pipeline Operations for Gas/Liquids

Default version status: unaffected

  • 2025 P1unaffected
  • 2024 SP1 P2unaffected
  • 2023 SP1 P1unaffected
  • 2022 SP2 P3unaffected
  • 2021 SP2 P6unaffected

AVEVA AVEVA Pipeline Integrity Monitor (delivered on Pipeline Simulation media)

Default version status: unaffected

  • 2025 SP1 P2unaffected

AVEVA AVEVA Pipeline Training Simulator (delivered on Pipeline Simulation media)

Default version status: unaffected

  • 2025 SP1 P2unaffected

AVEVA Measurement Advisor

Default version status: unaffected

  • 2025 P1unaffected
  • 2021 SP1 HF16unaffected

References