Riskcovery

CVE-2025-7639

AVEVA Enterprise SCADA Deserialization of Untrusted Data

State
Published
Severity
6.1 Medium
Published
Aug 14, 2026
Updated
Aug 17, 2026
Reserved
Jul 14, 2025

Read the record on cve.org

Description

The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps".

Scores

CVSSScoreVectorSource
4.06.1 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:Nicscert
3.17.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:Hicscert

Weaknesses

Affected Products

ProductVersions
AVEVA Enterprise SCADAAVEVA
  • 2025Affected
  • 2024 through 2024 SP1 P01Affected
  • 2023 through 2023 SP1Affected
  • 2022 through 2022 SP2 P2Affected
  • 2021 SP2 P5 and earlierAffected
  • 2025 P1Not affected
  • 2024 SP1 P2Not affected
  • 2023 SP1 P1Not affected
  • 2022 SP2 P3Not affected
  • 2021 SP2 P6Not affected
AVEVA Enterprise SCADA HMIAVEVA
  • 2024Affected
  • 2023_P1 and earlierAffected
  • 2024 R2Affected
  • 2024 R2 HF7Not affected
  • 2024 P1Not affected
  • 2023 P2 HF1Not affected
AVEVA Pipeline Operations for Gas/LiquidsAVEVA
  • 2025 P1Not affected
  • 2024 SP1 P2Not affected
  • 2023 SP1 P1Not affected
  • 2022 SP2 P3Not affected
  • 2021 SP2 P6Not affected
AVEVA Pipeline Integrity Monitor (delivered on Pipeline Simulation media)AVEVA
  • 2025 SP1 P2Not affected
AVEVA Pipeline Training Simulator (delivered on Pipeline Simulation media)AVEVA
  • 2025 SP1 P2Not affected
Measurement AdvisorAVEVA
  • 2025 P1Not affected
  • 2021 SP1 HF16Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.