AVEVA PI Connector for CygNet Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet, affecting versions through 1.6.14. This vulnerability allows an administrator with local access to the connector admin portal to inject and persist arbitrary JavaScript code. The injected code would be executed by other users who visit the affected pages.

Impact

Exploitation of this vulnerability could lead to cross-site scripting, allowing for the injection of malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to PI Connector for CygNet version 1.7.0 or higher to address this vulnerability. For additional information, refer to the AVEVA Security Bulletin AVEVA-2025-002.