CVE-2025-41415: AVEVA PI Integrator Insertion of Sensitive Information into Sent Data

Published Aug 21, 2025
·
Updated

The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to access publication targets) to retrieve sensitive information that could then be used to gain additional access to downstream resources.

Affected Software

1 affected component
: AVEVA PI Integrator for Business Analytics: Versions 2020 R2 SP1 and prior

Remediation

Information

AVEVA recommends organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Users of affected product versions should apply security updates to mitigate the risk of exploit. * Upgrade to PI Integrator for Business Analytics 2020 R2 SP2 or higher. * From [OSISoft Customer Portal](PI Integrator for Business Analytics), search for "PI Integrator for Business Analytics" and select version 2020 R2 SP2 or higher.

Event History

Aug 21, 2025
CVE Published
via MITRE·07:57 PM
Data Sourced
via MITRE·07:57 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via ICS·08:08 PM
SeverityWeaknessAffected Software
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-41415?

CVE-2025-41415 is considered a high severity vulnerability that allows authenticated users to potentially access sensitive information.

2

How do I fix CVE-2025-41415?

To mitigate CVE-2025-41415, update the AVEVA PI Integrator for Business Analytics to a version later than 2020 R2 SP1.

3

Who is affected by CVE-2025-41415?

CVE-2025-41415 affects users of AVEVA PI Integrator for Business Analytics versions 2020 R2 SP1 and prior.

4

What type of information could be exposed in CVE-2025-41415?

CVE-2025-41415 could allow attackers to retrieve sensitive information leading to unauthorized access to downstream resources.

5

Can CVE-2025-41415 be exploited remotely?

CVE-2025-41415 requires authentication, meaning it cannot be exploited remotely by unauthenticated users.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203