CVE-2025-4417: AVEVA PI Connector for CygNet Cross-site Scripting
Published Jun 12, 2025
·Updated
A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscreant with local access to the connector admin portal to persist arbitrary JavaScript code that will be executed by other users who visit affected pages.
Affected Software
1 affected component
: AVEVA PI Connector for CygNet: Version 1.6.14 and prior
Remediation
Information
AVEVA recommends that organizations evaluate the impact of these
vulnerabilities based on their operational environment, architecture,
and product implementation. Users of affected product versions should
apply security updates to mitigate the risk of exploit.
All affected versions of PI Connector for CygNet can be fixed by upgrading to PI Connector for CygNet v1.7.0 or higher. From OSISoft Customer Portal https://my.osisoft.com/ , search for "PI Connector for CygNet" and select Version 1.7.0 or higher.
For additional information please refer to AVEVA-2025-002 https://www.aveva.com/en/support-and-success/cyber-security-updates/ .
Event History
Jun 12, 2025
CVE Published
via MITRE·07:32 PM
Data Sourced
via MITRE·07:32 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-4417?
CVE-2025-4417 is classified as a high severity cross-site scripting vulnerability.
2
How do I fix CVE-2025-4417?
To fix CVE-2025-4417, upgrade to the latest version of AVEVA PI Connector for CygNet.
3
Who is affected by CVE-2025-4417?
CVE-2025-4417 affects users of AVEVA PI Connector for CygNet versions 1.6.14 and prior.
4
What type of vulnerability is CVE-2025-4417?
CVE-2025-4417 is a cross-site scripting (XSS) vulnerability.
5
What could be the impact of exploiting CVE-2025-4417?
Exploiting CVE-2025-4417 could allow an attacker to execute arbitrary JavaScript code in the context of other users.