EUVD-2026-73932
GHSA-xgr2-pj73-vrpj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-read access is sufficient (AV:L/PR:L); hardcoded key trivial to apply (AC:L); scope change reflects decrypted credential reuse against downstream infrastructure (C:H/I:H).
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
2DescriptionCVE.org
The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information.
AnalysisAI
Hard-coded cryptographic key (CWE-321) in AVEVA Pipeline Integrity Monitor through version 2025 SP1 P1 (build 7.1.9580.8513) enables any local user with read access to PIMBoards project files to decrypt and view sensitive protected content. The CVSS 4.0 vector's subsequent-system impacts (SC:H/SI:H) indicate the decrypted material - likely credentials, connection strings, or configuration data - is sufficient to compromise downstream pipeline control or monitoring infrastructure, making this a lateral-movement enabler in OT/ICS environments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local filesystem read access to PIMBoards project files on a host running AVEVA Pipeline Integrity Monitor through build 7.1.9580.8513. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 is driven primarily by the scope-changed subsequent-system metrics (SC:H/SI:H), which reflect that decrypted project file content likely contains credentials or access material reusable against connected pipeline infrastructure - not just passive data exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult AVEVA Security Bulletin AVEVA-2026-006 at https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-006.pdf for the official patch and exact fixed build number - the available intelligence identifies only the vulnerable ceiling (build 7.1.9580.8513) and does not specify a patched release version independently. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running AVEVA Pipeline Integrity Monitor through build 7.1.9580.8513 and immediately restrict file-system permissions on PIMBoards project files to administrative accounts only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today