Seven vulnerabilities were disclosed in Process Optimization (formerly ROMeo) 2024.1 and earlier on January 13, 2026, including a critical flaw enabling unauthenticated SYSTEM-level remote code execution.
The most severe vulnerability enables unauthenticated attackers to achieve remote code execution under system privileges, posing an immediate risk to industrial process control environments worldwide.
The primary threat stems from a critical code injection vulnerability in the application’s API layer. An unauthenticated attacker can exploit this flaw to execute arbitrary code with full system privileges on the “taoimr” service.
Potentially compromising the entire Model Application Server and connected infrastructure.
Vulnerability Summary
This attack requires no user interaction, is low-complexity, and can be executed remotely over the network, making it exceptionally dangerous for organizations running vulnerable versions.
Additional severe vulnerabilities include code injection via macro functionality that allows authenticated users to escalate from standard OS user to system-level privileges.
| CVE ID | Type | CVSS v4.0 | Severity | Impact |
|---|---|---|---|---|
| CVE-2025-61937 | Remote Code Execution (API) | 10.0 | Critical | Unauthenticated RCE under system privileges |
| CVE-2025-64691 | Code Injection (Macros) | 9.3 | Critical | Privilege escalation via TCL scripts |
| CVE-2025-61943 | SQL Injection | 9.3 | Critical | SQL Server admin code execution |
| CVE-2025-65118 | DLL Hijacking | 9.3 | Critical | System privilege escalation |
| CVE-2025-64729 | Missing ACLs | 8.6 | High | Project file tampering & privilege escalation |
| CVE-2025-65117 | Embedded OLE Objects | 8.5 | High | Malicious content delivery |
| CVE-2025-64769 | Cleartext Transmission | 7.6 | High | Data interception via Man-in-the-Middle |
SQL injection flaws in the Captive Historian component that grant attackers SQL Server administrative access.
A DLL hijacking vulnerability enables authenticated users to load arbitrary code and elevate their privileges to system-level.
These attack vectors collectively demonstrate sophisticated exploitation pathways that could completely compromise affected systems.
AVEVA recommends immediate action: organizations should upgrade to AVEVA Process Optimization 2025 or higher to patch all identified vulnerabilities.
As an interim defensive measure, administrators should implement network firewall rules restricting the taoimr service (default ports 8888/8889) to trusted sources only.
Apply strict access control lists to installation and data folders, and maintain rigorous change management for project files.
The vulnerabilities were discovered during a planned penetration test by Veracode security researcher Christopher Wu and coordinated with CISA.
Organizations operating AVEVA Process Optimization environments should prioritize patching immediately to prevent exploitation of these critical flaws in their industrial control systems infrastructure.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
