CVE-2025-54460: AVEVA PI Integrator Unrestricted Upload of File with Dangerous Type

Published Aug 21, 2025
·
Updated

The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publication targets of type Text File or HDFS) to upload and persist files that could potentially be executed.

Affected Software

1 affected component
: AVEVA PI Integrator for Business Analytics: Versions 2020 R2 SP1 and prior

Remediation

Information

AVEVA recommends organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Users of affected product versions should apply security updates to mitigate the risk of exploit. * Upgrade to PI Integrator for Business Analytics 2020 R2 SP2 or higher. * From [OSISoft Customer Portal](PI Integrator for Business Analytics), search for "PI Integrator for Business Analytics" and select version 2020 R2 SP2 or higher.

Event History

Aug 21, 2025
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via ICS·08:08 PM
SeverityWeaknessAffected Software
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-54460?

CVE-2025-54460 is considered a significant vulnerability due to its potential for authenticated users to upload and execute malicious files.

2

How do I fix CVE-2025-54460?

To mitigate CVE-2025-54460, upgrade to a patched version of AVEVA PI Integrator for Business Analytics beyond 2020 R2 SP1.

3

Who is affected by CVE-2025-54460?

CVE-2025-54460 affects users of AVEVA PI Integrator for Business Analytics versions 2020 R2 SP1 and earlier.

4

What can an attacker do with CVE-2025-54460?

An attacker exploiting CVE-2025-54460 could upload files that may allow for remote code execution under certain conditions.

5

Is there a public advisory for CVE-2025-54460?

Yes, public advisories regarding CVE-2025-54460 can be found through AVEVA's security bulletin and other cybersecurity resources.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203