AVEVA Process Optimization Privilege Escalation Vulnerability

A vulnerability in AVEVA Process Optimization (formerly ROMeo) versions through 2024.1 has been identified, allowing an authenticated user with Process Optimization Designer privileges to embed OLE objects into graphics. This could lead to unauthorized privilege escalation by assuming the identity of a victim user who interacts with the modified graphical elements.

Impact

Exploitation of this vulnerability could enable an authenticated user to escalate privileges, potentially leading to unauthorized access or actions within the application.

Remediation

Users are advised to update to AVEVA Process Optimization version 2024.2 or later, where this vulnerability has been addressed.