CVE-2025-54460

Summary

The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publication targets of type Text File or HDFS) to upload and persist files that could potentially be executed.

Affected Software

Weaknesses

• CWE-434: CWE-434

Workarounds

Additionally, AVEVA recommends the following general defensive measures:

• Audit assigned permissions to ensure that only trusted users are given access rights to publication targets: https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1013185.html

• Ensure publication targets of type Text File or HDFS are configured to limit allowed output file extensions and limit output folders to be logically isolated from critical system components or executable paths:

• https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04

• ←Previous
• Next→