CVE-2025-64769
Aveva Process Optimization ≤ 2025
Raw vector
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-64769 is a high-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Aveva Process Optimization. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-64769 is a vulnerability in the Process Optimization application suite, where connection channels and protocols are not encrypted by default. This exposes communications to potential hijacking or data leakage in man-in-the-middle attacks or passive inspection scenarios. The issue is rated with a CVSS v3.1 base score of 7.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) and is associated with CWE-319 (Cleartext Transmission of Sensitive Information).
The vulnerability can be exploited by unauthenticated attackers (PR:N) with adjacent network access (AV:A), though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation allows high-impact confidentiality and integrity violations, such as data interception or modification, alongside low availability impact (A:L), all within unchanged scope (S:U).
Advisories including CISA's ICSA-26-015-01 and AVEVA's software support and cyber-security updates provide details on mitigations and patches; practitioners should consult https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01, https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea, and https://www.aveva.com/en/support-and-success/cyber-security-updates/ for remediation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2989
Vulnerability Data
The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subject to hijacking or data leakage in certain man-in-the-middle or passive inspection scenarios.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-8 directly requires protecting confidentiality of transmitted information, which structurally eliminates cleartext transmission of sensitive data.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encryption of data-in-transit directly prevents cleartext transmission while the control also addresses integrity and availability.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Specifying encryption and other security technology for network services prevents transmission of sensitive information in cleartext over potentially untrusted channels.
Mandating cryptographic protection and stronger authentication on public networks stops the transmission of plaintext sensitive information.
Specifying communications-security requirements and secure remote-access methods (including encryption expectations) prevents the transmission of sensitive data in cleartext over home or public networks.
Armoured conduits, electromagnetic shielding and locked enclosures make passive eavesdropping on unencrypted traffic traversing the cables more difficult, mitigating exposure of sensitive data in transit.