EUVD-2025-210730
GHSA-4m9v-7gg3-m6j6
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description requires an authenticated 'DNA Authority - Operator' so PR:L (not PR:N); code runs under a different 'DNA Apps' group, giving S:C with full C/I/A impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps".
AnalysisAI
Insecure deserialization (CWE-502) in AVEVA Enterprise SCADA and related pipeline/HMI products allows an authenticated operator holding the 'DNA Authority - Operator' role to tamper with serialized data and achieve code execution during deserialization, running under the elevated Enterprise SCADA 'DNA Apps' security group. The flaw affects AVEVA Enterprise SCADA, Enterprise SCADA HMI, Pipeline Operations for Gas/Liquids, Pipeline Integrity Monitor, Pipeline Training Simulator, and Measurement Advisor, and is fixed per AVEVA Security Bulletin AVEVA-2026-005 and CISA advisory ICSA-26-225-01. There is no public exploit identified at time of analysis, but the reported CVSS 4.0 base score is 10.0.
Technical ContextAI
The root cause is CWE-502 (Deserialization of Untrusted Data): the affected .NET-based SCADA applications reconstruct serialized objects supplied by an operator-privileged user without adequate type/integrity validation, allowing a crafted object graph to trigger arbitrary code execution during deserialization. The affected components (CPE cpe:2.3:a:aveva:aveva_enterprise_scada, aveva_enterprise_scada_hmi, aveva_pipeline_operations_for_gas/liquids, aveva_pipeline_integrity_monitor, aveva_pipeline_training_simulator, and measurement_advisor) are part of AVEVA's DNA/Enterprise SCADA platform used for supervisory control of pipelines and utility operations. Because execution occurs under the 'DNA Apps' security group rather than the invoking operator's own context, successful exploitation crosses a privilege boundary - a scope change from the attacker's initial 'DNA Authority - Operator' role.
RemediationAI
Apply the vendor fix described in AVEVA Security Bulletin AVEVA-2026-005 (https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-005.pdf); an exact fixed version string is not present in the provided data, so the specific patched release should be confirmed directly from that bulletin and cross-referenced with CISA ICSA-26-225-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-01) and the CSAF file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-225-01.json. Until patched, restrict and audit assignment of the 'DNA Authority - Operator' privilege to the minimum set of trusted operators, since exploitation depends on that role; enforce network segmentation so SCADA/HMI hosts are isolated from general IT and reachable only from a hardened management network or jump host, and monitor for anomalous operator activity involving serialized data (trade-off: tighter operator-role restrictions and segmentation may impede legitimate operational workflows and remote engineering access). Follow CISA ICS defensive guidance to minimize network exposure of control-system devices and keep them behind firewalls, isolated from the business network.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today