CISA republishes AVEVA advisory on SCADA flaw tied to CVE-2025-7639
CISA said AVEVA Enterprise SCADA and related HMI products are affected by CVE-2025-7639, a deserialization flaw that could lead to code execution. The agency listed upgrade steps and configuration changes.
CISA republished an AVEVA security bulletin on Aug. 13 warning that CVE-2025-7639 affects AVEVA Enterprise SCADA and related HMI products and could let an authenticated attacker tamper with serialized data and potentially trigger code execution during deserialization.
CISA said the products are used in critical manufacturing environments, are deployed worldwide and that AVEVA reported the vulnerability to the agency.
What CISA said is affected
CISA listed AVEVA Enterprise SCADA 2025; Enterprise SCADA versions 2024, 2024_SP1_P01, 2023, 2023_SP1, 2022, 2022_SP2_P2, and 2021_SP2_P5; and AVEVA Enterprise SCADA HMI 2024|2024|R2 and 2023_P1 and earlier as known affected.
The advisory identifies the issue as CWE-502, or deserialization of untrusted data. CISA assigned the flaw a CVSS 3.1 score of 7.1, marked high, and a CVSS 4.0 score of 6.1, marked medium.
CISA said successful exploitation could allow an attacker to tamper with serialized data and potentially achieve code execution during deserialization. The bulletin also says an authenticated user with
Comments ()