CVE-2025-9317: Microsoft Edge Password Hash Vulnerability

CVE-2025-9317 Overview

CVE-2025-9317 is a cryptographic weakness affecting AVEVA Edge, tracked under CISA ICS Advisory ICSA-25-317-03 and AVEVA Security Bulletin 2025-006. An attacker with read access to Edge Project files or Edge Offline Cache files can reverse engineer app-native or Active Directory passwords by brute-forcing the weak hashes stored inside them. The flaw is categorized as [CWE-327]: Use of a Broken or Risky Cryptographic Algorithm. Successful exploitation exposes cleartext credentials that can enable lateral movement into industrial control environments and connected Active Directory domains.

Critical Impact
File-level read access to Edge project or cache artifacts leads to recovery of user and Active Directory passwords through offline brute-forcing of weak hashes.

Affected Products

AVEVA Edge (see vendor bulletin for affected version ranges)
Edge Project files stored on engineering workstations
Edge Offline Cache files distributed to runtime hosts

Discovery Timeline

2025-11-15 - CVE-2025-9317 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9317

Vulnerability Analysis

The vulnerability stems from the use of a weak hashing scheme to protect credentials that AVEVA Edge stores inside Project files and Offline Cache files. These artifacts contain hashed representations of app-native user passwords and, in configurations that authenticate against a domain, Active Directory passwords. Because the underlying algorithm lacks sufficient computational cost or salting, an attacker who obtains a copy of these files can run offline dictionary and brute-force attacks with commodity hardware. The attack requires only local read access to the artifacts, which are commonly duplicated during backups, replicated to runtime nodes, or shared across engineering teams. Once cleartext credentials are recovered, the attacker can authenticate as legitimate operators and, where AD credentials are exposed, pivot into the broader enterprise environment. This impacts both the confidentiality of stored secrets and the integrity of downstream systems that trust the recovered identities.

Root Cause

The root cause is the reliance on a cryptographic algorithm that does not meet modern standards for password storage. Secure password hashing requires algorithms designed to resist brute-forcing, such as Argon2, scrypt, bcrypt, or PBKDF2 with high iteration counts and per-user salts. The hash construction used in the affected Edge components does not provide that resistance, making recovery of the plaintext computationally feasible.

Attack Vector

Exploitation requires local access to Edge Project files or Edge Offline Cache files. An attacker who obtains these files, whether through a compromised workstation, exposed file share, backup media, or insider access, can extract the stored hashes and perform offline password cracking on separate infrastructure. No interaction with the Edge runtime or user is needed once the files are exfiltrated.

No verified public exploit code is available at the time of publication. See the AVEVA Security Bulletin 2025-006 and the GitHub CSAF resource for authoritative technical details.

Detection Methods for CVE-2025-9317

Indicators of Compromise

Unexpected read or copy operations against .APP, .APG, or Edge Offline Cache files on engineering workstations and runtime nodes.
Outbound transfers of Edge project archives to external storage, personal cloud services, or removable media.
Successful Active Directory logons from accounts tied to Edge operators shortly after project file access events.

Detection Strategies

Enable file access auditing on directories containing Edge Project and Offline Cache files and forward the events to a SIEM.
Correlate file read events on project artifacts with subsequent authentication events for the same user accounts.
Hunt for password-cracking tooling artifacts (hashcat, John the Ripper) on hosts that have interacted with Edge files.

Monitoring Recommendations

Monitor Active Directory for authentication anomalies on accounts referenced by Edge configurations, including logons from unusual hosts or during off-hours.
Track integrity of backup repositories that store Edge project files and alert on unauthorized enumeration.
Review file share permissions periodically to confirm that only authorized engineering staff can read Edge artifacts.

How to Mitigate CVE-2025-9317

Immediate Actions Required

Apply the fixes referenced in AVEVA Security Bulletin 2025-006 once available for your deployed Edge version.
Rotate all app-native and Active Directory passwords that were ever stored in Edge Project files or Offline Cache files.
Restrict filesystem and share permissions on Edge project directories to the smallest possible set of engineering accounts.

Patch Information

AVEVA has published remediation guidance in Security Bulletin AVEVA-2025-006 and CISA has issued advisory ICSA-25-317-03. Refer to the vendor bulletin for the specific fixed versions of AVEVA Edge and upgrade following the vendor's documented procedure. Do not rely on file-system permissions alone as a substitute for patching.

Workarounds

Segment engineering workstations and runtime hosts on isolated networks with no direct internet access, per CISA ICS defense-in-depth guidance.
Store Edge Project and Offline Cache files on encrypted volumes and restrict backup access to privileged administrators.
Avoid embedding Active Directory service accounts with broad privileges into Edge configurations; use dedicated low-privilege accounts.
Enforce strong, unique passwords so that even if hashes are recovered, brute-forcing remains computationally expensive.

bash

# Configuration example: audit read access to Edge project directories on Windows
auditpol /set /subcategory:"File System" /success:enable /failure:enable
icacls "C:\Path\To\Edge\Projects" /grant:r "EdgeEngineers:(OI)(CI)R" /inheritance:r
# Review Security log event ID 4663 for object access events on these files