Machine-generated analysis · WAYSCloud LLM
Authenticated users with DNA Authority – Operator privilege can modify serialized data, potentially leading to code execution. The issue affects AVEVA Enterprise SCADA versions from 2021 SP2 P5 through 2025.
Context
The advisory concerns AVEVA Enterprise SCADA (including HMI components) versions 2021_SP2_P5 through 2025 and related service packs. It states that an authenticated user with the "DNA Authority - Operator" role may tamper with serialized data, which could result in code execution during deserialization under the "DNA Apps" security group. The product is deployed worldwide in critical manufacturing sectors.
Operator considerations
Check: inventory installed AVEVA Enterprise SCADA versions and identify any that match the listed affected ranges.
Successful exploitation of this vulnerability could allow an attacker to tamper with serialized data, potentially resulting in code execution during deserialization.
Read the full advisory on CISA →