An authenticated vulnerability in AVEVA Process Optimization allows low-privileged users to achieve remote code execution on the backend SQL Server, posing a critical risk to system integrity.

This vulnerability is a SQL injection flaw (CWE-89) triggered by tampering with queries in the Captive Historian component. It requires an authenticated user with Process Optimization Standard User privileges to successfully execute arbitrary commands under the context of the SQL Server administrator.

The ability to execute code with administrative privileges on the SQL Server constitutes a complete compromise of the database environment. Given the CVSS score of 8.4, this vulnerability represents a high risk, potentially leading to unauthorized data access, modification, or total destruction of sensitive operational data. Successful exploitation could disrupt critical business processes and lead to severe regulatory or operational consequences.

Immediate Action: Update the AVEVA Process Optimization software to version 2025 or later as specified in the official AVEVA security bulletin.

Proactive Monitoring: Monitor SQL Server logs for unusual query patterns, unauthorized stored procedure execution, or unexpected service account activity originating from the Captive Historian component.

Compensating Controls: Implement strict database access controls and use a Web Application Firewall (WAF) or database-aware security monitoring tools to inspect and sanitize incoming queries for SQL injection signatures.

Public Exploit Available: Unknown

Organizations running affected versions of AVEVA Process Optimization must prioritize the upgrade to version 2025 immediately. The risk of lateral movement and total system compromise via SQL administrative access is significant. If an immediate patch is not feasible, restrict access to the affected interface to the minimum number of necessary users and increase audit logging for all database interactions.