CVE-2025-54460: File Upload RCE Vulnerability

CVE-2025-54460 Overview

CVE-2025-54460 is an unrestricted file upload vulnerability [CWE-434] affecting AVEVA products that expose Text File and HDFS publication targets. An authenticated attacker with privileges to create or access these publication targets can upload and persist arbitrary files to the host system. The persisted files could subsequently be executed, leading to integrity compromise of the affected environment. AVEVA disclosed the issue in security bulletin AVEVA-2025-004, and CISA published ICS advisory ICSA-25-224-04. The vulnerability was published to the National Vulnerability Database on August 21, 2025.

Critical Impact
Authenticated attackers can upload and persist arbitrary files through publication targets, enabling potential code execution on industrial control system hosts.

Affected Products

AVEVA products supporting Text File publication targets (see AVEVA-2025-004)
AVEVA products supporting HDFS publication targets (see AVEVA-2025-004)
Refer to the vendor bulletin for the complete list of affected versions

Discovery Timeline

2025-08-21 - CVE-2025-54460 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54460

Vulnerability Analysis

The vulnerability is classified as Unrestricted Upload of File with Dangerous Type [CWE-434]. The affected AVEVA components accept files written to publication targets without sufficiently restricting file type, content, or destination path. An authenticated user with permission to create or access Text File or HDFS publication targets can write attacker-controlled content to disk. Persisted files may then be executed by the host or by downstream processes that consume the publication output. The flaw affects integrity directly and can be chained with separate execution primitives to achieve code execution on the operating environment.

Root Cause

The root cause is insufficient validation of file content and destination when AVEVA writes data to Text File and HDFS publication targets. The product trusts authenticated user input to define publication target parameters, and it does not enforce constraints that would prevent attackers from persisting executable or otherwise dangerous file types.

Attack Vector

Exploitation requires network access and authenticated credentials with publication target privileges. The attacker configures or accesses a Text File or HDFS publication target, then submits a payload that AVEVA persists as a file on the target system. No user interaction is required. Successful exploitation depends on the attacker locating a path where the persisted file is later executed, parsed, or consumed by a privileged process. Refer to the AVEVA Security Bulletin AVEVA-2025-004 and CISA ICS Advisory ICSA-25-224-04 for vendor-specific technical detail.

Detection Methods for CVE-2025-54460

Indicators of Compromise

Unexpected files written to directories backing Text File publication targets, especially executables, scripts, or DLLs
New or modified HDFS objects produced by AVEVA service accounts that contain script or binary content
Publication target configurations created or altered by accounts that do not normally perform engineering tasks

Detection Strategies

Audit AVEVA application logs for creation and modification of Text File and HDFS publication targets, correlating to the authenticating principal
Monitor file system telemetry for write events from AVEVA process identities into non-standard directories
Alert on execution events where the parent file was originally written by an AVEVA publication process

Monitoring Recommendations

Forward AVEVA audit logs, host process telemetry, and HDFS access logs to a centralized SIEM for correlation
Track privileged operations against publication target objects with a low-and-slow detection horizon, since exploitation requires valid credentials
Review service account activity for AVEVA publication services and baseline expected output paths

How to Mitigate CVE-2025-54460

Immediate Actions Required

Apply the fixed versions identified in AVEVA Security Bulletin AVEVA-2025-004
Inventory all accounts holding privileges to create or access Text File and HDFS publication targets and remove unnecessary grants
Rotate credentials for accounts that have configured publication targets if compromise is suspected

Patch Information

AVEVA has published remediation guidance in security bulletin AVEVA-2025-004. CISA mirrors the guidance in ICS advisory ICSA-25-224-04. Administrators should follow the vendor-supplied upgrade path for each affected product, validate the fix in a staging environment, and schedule deployment according to industrial change control procedures.

Workarounds

Restrict publication target privileges to a minimal set of trusted engineering accounts using role-based access control
Place publication target output directories on file systems mounted with noexec where supported by the platform
Apply network segmentation so that AVEVA management interfaces are only reachable from engineering workstations on isolated VLANs
Enable application allowlisting on hosts running AVEVA services to block execution of files written by publication processes

bash

# Example: mount publication target directory with noexec on Linux hosts
# Edit /etc/fstab to enforce noexec on the publication output volume
/dev/mapper/aveva-pub  /var/aveva/publications  ext4  defaults,nodev,nosuid,noexec  0  2

# Remount to apply
mount -o remount /var/aveva/publications

# Verify mount options
mount | grep /var/aveva/publications