AVEVA Flaw Lets Attackers Run Code as SYSTEM

A critical Aveva flaw uncovered in the Process Optimization software, previously known as ROMeo, exposes industrial systems to unauthenticated remote code execution under system privileges. Disclosed on Jan. 13, 2026, the flaw is part of seven newly reported vulnerabilities affecting version 2024.1 and earlier.

The most severe issue lies in a code injection vulnerability within the API layer. Attackers can exploit the “taoimr” service remotely and without authentication, allowing full control of the underlying system. Additional risks include macro-based code execution, SQL injection, DLL hijacking, and weak access controls.

Researchers at Veracode discovered the flaws during a penetration test and coordinated with CISA. AVEVA urged users to upgrade to the 2025 release or higher. In the interim, firms should restrict port access, enforce ACLs, and monitor file changes closely.

Due to the high-impact risks of the Aveva flaw, organizations should implement mitigations immediately.

Read the full article at: https://cybersecuritynews.com/aveva-software-vulnerabilities/