CVE-2025-4418: AVEVA PI Connector for CygNet Improper Validation of Integrity Check Value

Published Jun 12, 2025

Updated

An improper validation of integrity check value vulnerability exists in

AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow a miscreant with elevated privileges to modify PI Connector for CygNet local data files (cache and buffers) in a way that causes the connector service to become unresponsive.

Affected Software

1 affected component

: AVEVA PI Connector for CygNet: Version 1.6.14 and prior

Remediation

Information

AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Users of affected product versions should apply security updates to mitigate the risk of exploit. All affected versions of PI Connector for CygNet can be fixed by upgrading to PI Connector for CygNet v1.7.0 or higher. From OSISoft Customer Portal https://my.osisoft.com/ , search for "PI Connector for CygNet" and select Version 1.7.0 or higher. For additional information please refer to AVEVA-2025-002 https://www.aveva.com/en/support-and-success/cyber-security-updates/ .

Event History

Jun 12, 2025

CVE Published

via MITRE·07:37 PM

Data Sourced

via MITRE·07:37 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-25-162-09

Frequently Asked Questions

What is the severity of CVE-2025-4418?

CVE-2025-4418 has been rated as a high severity vulnerability due to its potential for exploitation by users with elevated privileges.

How do I fix CVE-2025-4418?

To mitigate CVE-2025-4418, it is recommended to update AVEVA PI Connector for CygNet to the latest version beyond 1.6.14.

What type of vulnerability is CVE-2025-4418?

CVE-2025-4418 is an improper validation of integrity check value vulnerability.

Who is affected by CVE-2025-4418?

Organizations using AVEVA PI Connector for CygNet versions 1.6.14 and prior are affected by CVE-2025-4418.

What could an attacker do if CVE-2025-4418 is exploited?

If exploited, CVE-2025-4418 could allow an attacker to modify local data files for PI Connector for CygNet, compromising data integrity.