Description
The vulnerability, if exploited, could allow an authenticated miscreant
with "DNA Authority - Operator" privilege to tamper with serialized
data, potentially resulting in code execution during deserialization
under the privilege of Enterprise SCADA security group "DNA Apps".
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AVEVA | AVEVA Enterprise SCADA | 2025, 2024 – ≤ 2024 SP1 P01, 2023 – ≤ 2023 SP1, 2022 – ≤ 2022 SP2 P2, ≤ 2021 SP2 P5 | 2025 P1 |
| AVEVA | AVEVA Enterprise SCADA HMI | 2024, ≤ 2023_P1, 2024 R2 | 2024 R2 HF7 |
| AVEVA | AVEVA Pipeline Operations for Gas/Liquids | — | 2025 P1 |
| AVEVA | AVEVA Pipeline Integrity Monitor (delivered on Pipeline Simulation media) | — | 2025 SP1 P2 |
| AVEVA | AVEVA Pipeline Training Simulator (delivered on Pipeline Simulation media) | — | 2025 SP1 P2 |
| AVEVA | Measurement Advisor | — | 2025 P1 |
Advisories 1
- ICSA-26-225-01 AVEVA Enterprise SCADA CISA ICS & IT advisories · Aug 13, 2026