Industrial Alert: Critical RCE in AVEVA Software Rated CVSS 10

AVEVA has issued a critical alert for its Process Optimization software (formerly ROMeo), detailing multiple vulnerabilities, including a Remote Code Execution (RCE) flaw with a maximum CVSS score of 10.0 (CVE-2025-61937) that could allow an unauthenticated attacker with network access to seize complete control of the Model Application Server by exploiting the API.

The bulletin notes the RCE exists in AVEVA Process Optimization 2024.1 and all prior versions, with recommended action to upgrade to AVEVA Process Optimization 2025 or higher.

In addition, several weaker flaws with CVSS 9.3—Macro Manipulation (CVE-2025-64691), SQL Injection (CVE-2025-61943), and DLL Hijacking (CVE-2025-65118)—could enable authenticated attackers to escalate privileges or gain administrative control, while other issues such as cleartext transmission (CVE-2025-64769), OLE object handling (CVE-2025-65117), and missing access controls (CVE-2025-64729) pose further risks.

For organisations unable to patch immediately, AVEVA recommends temporary defensive measures including restricting traffic to the taoimr service, locking down installation and data folders with ACLs, and maintaining a trusted chain-of-custody for project files.