CVE-2025-61943: Aveva Process Optimization SQLi Vulnerability

CVE-2025-61943 Overview

CVE-2025-61943 is a critical SQL Injection vulnerability affecting AVEVA Process Optimization software. The vulnerability allows an authenticated user with Process Optimization Standard User privileges to tamper with queries in Captive Historian, potentially achieving code execution under SQL Server administrative privileges. Successful exploitation could result in complete compromise of the SQL Server, affecting both the confidentiality and integrity of sensitive industrial process data.

Critical Impact

Authenticated attackers can escalate privileges through SQL injection to gain SQL Server administrative access, potentially compromising the entire database infrastructure and connected industrial systems.

Affected Products

• AVEVA Process Optimization (all versions prior to patched release)

Discovery Timeline

• 2026-01-16 - CVE-2025-61943 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2025-61943

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), a severe input validation flaw that allows attackers to manipulate database queries through user-controlled input. In the context of AVEVA Process Optimization, an authenticated user with standard privileges can craft malicious input that modifies the structure of SQL queries executed by the Captive Historian component.

The attack requires local access and authenticated privileges (Process Optimization Standard User), but once these conditions are met, the exploitation complexity is low. The vulnerability enables attackers to bypass the intended access controls and execute arbitrary SQL commands with elevated database privileges, potentially including SQL Server sysadmin level access.

Root Cause

The root cause of this vulnerability lies in improper input sanitization within the Captive Historian component of AVEVA Process Optimization. User-supplied input is incorporated directly into SQL queries without adequate validation or parameterization. This failure to properly sanitize or escape special SQL characters allows attackers to inject malicious SQL statements that are executed by the database engine with administrative privileges.

Attack Vector

The attack vector for CVE-2025-61943 requires local access to the affected system. An attacker must first authenticate as a Process Optimization Standard User, after which they can exploit the SQL injection vulnerability in the Captive Historian query interface. By crafting specially formatted input containing SQL metacharacters and commands, the attacker can manipulate the underlying database queries.

The exploitation path typically involves injecting SQL commands that leverage stored procedures or extended stored procedures to execute operating system commands, effectively pivoting from database access to full system compromise. Given that the vulnerability provides SQL Server administrative privileges, attackers could exfiltrate sensitive process data, modify historian records, deploy ransomware, or establish persistent access to the industrial control system environment.

Detection Methods for CVE-2025-61943

Indicators of Compromise

• Unusual or malformed SQL queries in SQL Server logs originating from the Captive Historian component
• Unexpected use of SQL Server extended stored procedures such as xp_cmdshell or sp_OACreate
• Authentication anomalies showing standard users accessing administrative database functions
• Unexpected outbound network connections from the SQL Server instance

Detection Strategies

• Monitor SQL Server audit logs for injection patterns including single quotes, UNION SELECT, EXEC, and encoded SQL commands
• Implement database activity monitoring (DAM) solutions to detect privilege escalation attempts
• Configure SentinelOne Singularity to monitor for suspicious process execution chains involving SQL Server processes
• Deploy network-based intrusion detection rules targeting SQL injection payloads in Historian traffic

Monitoring Recommendations

• Enable SQL Server Extended Events or SQL Trace to capture all queries executed against Historian databases
• Configure alerting for execution of sensitive stored procedures by non-administrative accounts
• Implement file integrity monitoring on SQL Server system directories to detect unauthorized modifications
• Review Process Optimization user access logs for anomalous query patterns

How to Mitigate CVE-2025-61943

Immediate Actions Required

• Apply the latest security patch from AVEVA immediately following change management procedures
• Implement network segmentation to restrict local access to affected Process Optimization systems
• Review and minimize user accounts with Process Optimization Standard User privileges
• Enable SQL Server audit logging if not already configured

Patch Information

AVEVA has released a security update to address this vulnerability. Administrators should download the patched version from the AVEVA Product Download Portal. Additional guidance is available through the AVEVA Cyber Security Updates page. For detailed technical information regarding industrial control system implications, refer to the CISA ICS Advisory.

Workarounds

• Restrict Process Optimization Standard User accounts to only those personnel who absolutely require access
• Implement application-level firewall rules to filter potentially malicious SQL patterns in queries
• Configure SQL Server to run with minimal required privileges and disable unnecessary extended stored procedures
• Consider temporarily disabling network access to the Captive Historian interface until patching is complete

# Disable xp_cmdshell on SQL Server as defense-in-depth
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;