CVE-2025-61937

An error classified as CWE-94 (Code Injection) allows an attacker to inject and execute malicious code without requiring authentication. The attack is possible remotely, over the network, without any user interaction or special configuration conditions. The executed code runs in the context of the 'taoimr' system service privileges, providing the attacker with a high level of access to the operating system.

An attacker can gain full control over the model application server, including the ability to read, modify, and delete data as well as install malicious software. According to the CVSS vector, the impact includes compromising the confidentiality, integrity, and availability of both the target system and associated systems.

Patches available from the manufacturer should be applied according to references — updates available through the Aveva support portal (softwaresupportsp.aveva.com) and the Aveva cybersecurity updates page. It is recommended to isolate Aveva Process Optimization servers from untrusted networks until the patch is applied and to monitor network traffic directed to the 'taoimr' service.

Aveva Process Optimization — versions indicated in the manufacturer's references (CISA ICS advisory: ICSA-26-015-01 and Aveva support page).