AVEVA Pipeline Simulation Missing Authorization Vulnerability Allowing Privilege Escalation

A vulnerability exists in AVEVA Pipeline Simulation 2025 SP1 (build 7.1.9497.6351) and all prior versions) due to missing authorization on certain API methods. This vulnerability could allow an unauthenticated individual to perform actions reserved for Simulator Instructor or Simulator Developer (Administrator) roles. Exploitation of this vulnerability could lead to unauthorized privilege escalation, with the potential to modify simulation parameters, training configurations, and training records.

Impact

Exploitation of this vulnerability could result in unauthorized privilege escalation, allowing an attacker to access and modify simulation parameters, training configurations, and training records.

Remediation

Users can upgrade to AVEVA Pipeline Simulation 2025 SP1 P01 (build 7.1.9580.8513) or higher to address this vulnerability. For more information, visit the AVEVA Software Support site.