CVE-2025-64769
📋 TL;DR
The Process Optimization application suite uses unencrypted communication channels by default, allowing attackers to intercept, modify, or steal sensitive data through man-in-the-middle attacks. This affects organizations using AVEVA's Process Optimization software in industrial control environments.
💻 Affected Systems
- AVEVA Process Optimization
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to operational disruption, safety incidents, or theft of proprietary process data.
Likely Case
Unauthorized data collection of process information, configuration details, or operational parameters that could be used for reconnaissance or competitive intelligence.
If Mitigated
Limited impact with proper network segmentation and encryption controls, though some risk remains from insider threats or compromised internal systems.
🎯 Exploit Status
Exploitation requires network access to unencrypted channels; no authentication bypass needed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Consult vendor advisory for specific patched versions
Vendor Advisory: https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea
Restart Required: Yes
Instructions:
1. Download and install the latest patch from AVEVA support portal. 2. Restart affected services. 3. Verify encryption is enabled on all communication channels.
🔧 Temporary Workarounds
Enable Channel Encryption
allConfigure the application to use encrypted communication protocols instead of default unencrypted channels
Configuration steps vary by installation; consult AVEVA documentation
Network Segmentation
allIsolate Process Optimization systems in protected network segments with strict access controls
Implement firewall rules to restrict access to necessary ports only
🧯 If You Can't Patch
- Implement network-level encryption (VPN, TLS tunneling) for all communication to/from affected systems
- Deploy network monitoring and intrusion detection specifically for unencrypted traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check application configuration for unencrypted communication channels; monitor network traffic for cleartext protocol usageCheck Version:
Check application version through AVEVA administration interface or installed program detailsVerify Fix Applied:
Verify patch installation via version check and confirm encrypted communication via network traffic analysis📡 Detection & Monitoring
Log Indicators:
- Unauthorized connection attempts to application ports
- Configuration changes to communication settings
Network Indicators:
- Cleartext traffic on application ports (typically industrial protocols)
- Unexpected external connections to internal systems
SIEM Query:
source_ip IN (external_ips) AND dest_port IN (application_ports) AND protocol = 'tcp' AND NOT encrypted = true🔗 References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json
- https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea
- https://www.aveva.com/en/support-and-success/cyber-security-updates/
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01
