{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2025-41415", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2025-07-31T16:41:30.376Z", "datePublished": "2025-08-21T19:57:26.099Z", "dateUpdated": "2025-08-21T20:13:40.413Z" }, "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "PI Integrator", "vendor": "AVEVA", "versions": [ { "lessThan": "2020 R2 SP1", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Maxime Escourbiac, Michelin CERT, and Adam Bertrand, Abicom for Michelin CERT reported these vulnerabilities to AVEVA." } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "The vulnerability, if exploited, could allow an authenticated miscreant \n(with privileges to access publication targets) to retrieve sensitive \ninformation that could then be used to gain additional access to \ndownstream resources." } ], "value": "The vulnerability, if exploited, could allow an authenticated miscreant \n(with privileges to access publication targets) to retrieve sensitive \ninformation that could then be used to gain additional access to \ndownstream resources." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] }, { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-201", "description": "CWE-201", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-08-21T19:57:26.099Z" }, "references": [ { "url": "https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

AVEVA recommends organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.

\n\n\n
" } ], "value": "AVEVA recommends organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.\n\n\n\n * Upgrade to PI Integrator for Business Analytics 2020 R2 SP2 or higher.\n\n * From [OSISoft Customer Portal](PI Integrator for Business \nAnalytics), search for \"PI Integrator for Business Analytics\" and select\n version 2020 R2 SP2 or higher." } ], "source": { "advisory": "ICSA-25-224-04", "discovery": "EXTERNAL" }, "title": "AVEVA PI Integrator Insertion of Sensitive Information into Sent Data", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Additionally, AVEVA recommends the following general defensive measures:

\n
  • Ensure\n publication targets of type Text File or HDFS are configured to limit \nallowed output file extensions and limit output folders to be logically \nisolated from critical system components or executable paths:
    • \n
  • https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html
    • https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023009.htmlConsider applying Windows Defender Application Control (WDAC) to prevent execution of unauthorized executables: https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager\n\n
    " } ], "value": "Additionally, AVEVA recommends the following general defensive measures:\n\n\n\n * Audit assigned permissions to ensure that only trusted users are given access rights to publication targets: https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1013185.html \n\n\n * Ensure\n publication targets of type Text File or HDFS are configured to limit \nallowed output file extensions and limit output folders to be logically \nisolated from critical system components or executable paths:\n\n * https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html \n https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager" } ], "x_generator": { "engine": "Vulnogram 0.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2025-08-21T20:13:29.628004Z", "id": "CVE-2025-41415", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-21T20:13:40.413Z" } } ] } }