🎯Basically, a flaw lets anyone change important settings in AVEVA's software without permission.
What Happened
A serious vulnerability has been discovered in AVEVA Pipeline Simulation that could allow an unauthenticated attacker to modify critical simulation parameters, training configurations, and training records. This flaw affects all versions of the software up to and including 2025_SP1_build_7.1.9497.6351.
The Flaw
The vulnerability, identified as CVE-2026-5387, is classified as a Missing Authorization issue. It enables attackers to perform operations meant for privileged roles, such as Simulator Instructors or Developers, leading to potential privilege escalation. This could result in unauthorized changes that compromise the integrity of training simulations.
What's at Risk
The risk is significant, especially for organizations in the Critical Manufacturing sector that rely on accurate simulation data for training and operational purposes. If exploited, this vulnerability could disrupt training processes and lead to incorrect operational settings, potentially affecting safety and efficiency.
Patch Status
AVEVA has released a fix for this vulnerability. Users are advised to upgrade to AVEVA Pipeline Simulation 2025 SP1 P01 (build 7.1.9580.8513) or higher to mitigate the risk. The patch addresses the missing authorization issue, ensuring that only authenticated users can modify simulation parameters.
Recommended Actions
To protect against this vulnerability, organizations should take the following actions:
Containment
- 1.Upgrade to the latest version of AVEVA Pipeline Simulation as soon as possible.
- 2.Restrict Network Access: Implement host-based and network firewall controls to limit access to the Pipeline Simulation Server API.
Remediation
Conclusion
This vulnerability highlights the importance of maintaining updated software in critical infrastructure systems. Organizations must act quickly to implement the recommended patches and security measures to safeguard their operations.
🔒 Pro insight: This vulnerability underscores the need for stringent access controls in critical infrastructure systems to prevent unauthorized modifications.
