CVE-2025-65118
📋 TL;DR
This vulnerability allows authenticated standard users to trick Process Optimization services into loading arbitrary code, leading to privilege escalation to system-level access. This could result in complete compromise of the Model Application Server. Organizations using affected AVEVA software versions are impacted.
💻 Affected Systems
- AVEVA Process Optimization
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the Model Application Server, potentially leading to data theft, system manipulation, or lateral movement within the network.
Likely Case
Privilege escalation allowing authenticated users to execute arbitrary code with system privileges, compromising the server's integrity and confidentiality.
If Mitigated
Limited impact if proper network segmentation, least privilege access controls, and monitoring are implemented, though the vulnerability still exists.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of Process Optimization services; CWE-427 indicates uncontrolled search path vulnerability
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea
Restart Required: Yes
Instructions:
1. Review vendor advisory for affected versions. 2. Download and apply the official patch from AVEVA. 3. Restart affected services/systems as required. 4. Verify patch installation.
🔧 Temporary Workarounds
Restrict User Privileges
windowsLimit standard user access to Process Optimization services and Model Application Server
Implement Application Whitelisting
windowsUse application control policies to prevent unauthorized code execution
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Model Application Server from untrusted networks
- Enforce least privilege access controls and monitor for suspicious privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check installed AVEVA Process Optimization version against vendor advisory; review system logs for unauthorized privilege escalation attemptsCheck Version:
Check AVEVA software version through control panel or vendor-specific management toolsVerify Fix Applied:
Verify patch installation through version check; test that standard users cannot escalate privileges via Process Optimization services📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Process Optimization service loading unusual DLLs or executables
- Standard user accounts performing system-level operations
Network Indicators:
- Unusual outbound connections from Model Application Server
- Suspicious authentication patterns to Process Optimization services
SIEM Query:
source="windows_security" event_id="4672" OR event_id="4688" | where user_account contains "standard" AND process_name contains "Process Optimization"🔗 References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json
- https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea
- https://www.aveva.com/en/support-and-success/cyber-security-updates/
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01
