Home

Description

The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the model application server.

PUBLISHED Reserved 2025-11-24 | Published 2026-01-16 | Updated 2026-01-16 | Assigner icscert




CRITICAL: 10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CRITICAL: 10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

CWE-94

Product status

Default status
unaffected

Any version
affected

Credits

Christopher Wu of Veracode reported these vulnerabilities to AVEVA. finder

References

www.aveva.com/en/support-and-success/cyber-security-updates/

softwaresupportsp.aveva.com/...3-0d85-4fde-ac11-5239e87a68ea

www.cisa.gov/news-events/ics-advisories/icsa-26-015-01

github.com/...p/csaf_files/OT/white/2026/icsa-26-015-01.json

cve.org (CVE-2025-61937)

nvd.nist.gov (CVE-2025-61937)

Download JSON