CVE-2025-61943
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
2Description
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server.
Analysis
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server. [CVSS 8.4 HIGH]
Technical Context
Classified as CWE-89 (SQL Injection). Affects Process Optimization. The vulnerability, if exploited, could allow an authenticated miscreant
(Process Optimization Standard User) to tamper with queries in Captive
Historian and achieve code execution under SQL Server administrative
privileges, potentially resulting in complete compromise of the SQL
Server.
Affected Products
Vendor: Aveva. Product: Process Optimization.
Remediation
Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today