AVEVA records

71 published records for vendor aveva.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 4
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

71 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
44Plan	CVE-2022-23854Proof of concept	AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated useraveva · intouch access anywhere · CWE-23 Pre-auth Path traversal	High7.5	—	46.0%	Dec 23, 2022
44Plan	CVE-2019-6543Proof of concept	AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 20aveva · indusoft web studio · CWE-306 Pre-auth Auth bypass	Critical9.8	—	17.3%	Feb 12, 2019
42Plan	CVE-2011-3143No exploit	Use-after-free vulnerability in Control Microsystems ClearSCADA 2005, 2007, and 2009 before R2.3 and R1.4, as used in SCX before 67 R4.5 andaveva · clearscada · CWE-399 pre-auth RCE	Critical10.0	—	7.5%	Aug 16, 2011
41Plan	CVE-2018-10628No exploit	AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a aveva · intouch 2014 · CWE-121 pre-auth RCE Memory safety	Critical9.8	—	5.4%	Jul 24, 2018
40Plan	CVE-2018-17914No exploit	InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2.aveva · indusoft web studio · CWE-258 Pre-auth	Critical9.8	—	4.6%	Nov 2, 2018
40Plan	CVE-2018-10620No exploit	AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully craaveva · indusoft web studio · CWE-121 Pre-auth Memory safety	Critical9.8	—	4.2%	Jul 19, 2018
40Plan	CVE-2018-17916No exploit	InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2.aveva · indusoft web studio · CWE-121 Pre-auth Memory safety	Critical9.8	—	3.7%	Nov 2, 2018
40Plan	CVE-2020-13501No exploit	An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.aveva · edna enterprise data historian · CWE-89 Pre-auth SQL injection	Critical9.8	—	2.9%	Sep 24, 2020
40Plan	CVE-2020-13500No exploit	SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.aveva · edna enterprise data historian · CWE-89 Pre-auth SQL injection	Critical9.8	—	2.9%	Sep 24, 2020
40Plan	CVE-2020-13499No exploit	An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.aveva · edna enterprise data historian · CWE-89 Pre-auth SQL injection	Critical9.8	—	2.9%	Sep 24, 2020
40Plan	CVE-2017-5158No exploit	An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior.aveva · wonderware intouch access anywhere · CWE-200 Pre-auth Info leak	Critical9.8	—	2.4%	Apr 20, 2017
40Plan	CVE-2025-61937No exploit	AVEVA Process Optimization Code Injectionaveva · process optimization · CWE-94 pre-auth RCE	Critical10.0	—	1.5%	Jan 15, 2026
39Monitor	CVE-2020-13504No exploit	Parameter AttFilterValue in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks.aveva · edna enterprise data historian · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.2%	Sep 24, 2020
39Monitor	CVE-2020-13505No exploit	Parameter psClass in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks.aveva · edna enterprise data historian · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.2%	Sep 24, 2020
39Monitor	CVE-2021-33008No exploit	AVEVA System Platform Missing Authentication for Critical Functionaveva · system platform · CWE-306 Pre-auth Auth bypass	Critical9.8	—	1.2%	Apr 4, 2022
39Monitor	CVE-2021-42796No exploit	An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticateaveva · edge · CWE-78 pre-auth RCE Command injection	Critical9.8	—	1.1%	Dec 15, 2023
39Monitor	CVE-2022-1467No exploit	AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphereaveva · intouch access anywhere · CWE-668 RCE	Critical9.9	—	1.0%	May 23, 2022
39Monitor	CVE-2021-32959No exploit	AVEVA SuiteLink Server Buffer Overflowaveva · suitelink · CWE-122 Pre-auth Memory safety	Critical9.8	—	0.9%	Sep 23, 2021
39Monitor	CVE-2023-1256No exploit	The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow anaveva · aveva plant scada · CWE-285 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.7%	Mar 16, 2023
37Monitor	CVE-2025-61943No exploit	AVEVA Process Optimization SQL Injectionaveva · process optimization · CWE-89 SQL injection Local privilege escalation	Critical9.3	—	0.3%	Jan 15, 2026
37Monitor	CVE-2025-64691No exploit	AVEVA Process Optimization Code Injectionaveva · process optimization · CWE-94 RCE Local privilege escalation	Critical9.3	—	0.3%	Jan 15, 2026
37Monitor	CVE-2025-65118No exploit	AVEVA Process Optimization Uncontrolled Search Path Elementaveva · process optimization · CWE-427 RCE Local privilege escalation	Critical9.3	—	0.3%	Jan 15, 2026
36Monitor	CVE-2022-28685No exploit	This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802aveva · aveva edge · CWE-502 RCE Deserialization	High7.8	—	17.2%	Mar 29, 2023
35Monitor	CVE-2019-6525No exploit	AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and iaveva · wonderware system platform · CWE-522 Info leak	High8.8	—	1.3%	Apr 11, 2019
35Monitor	CVE-2017-5156No exploit	A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior.aveva · wonderware intouch access anywhere · CWE-352 Pre-auth CSRF	High8.8	—	1.0%	Apr 20, 2017

CVE-2022-23854
44Plan
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user
HighCVSS 7.5Proof of conceptEPSS 46%
- Pre-auth
- Path traversal
aveva · intouch access anywhereDec 23, 2022
CVE-2019-6543
44Plan
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 20
CriticalCVSS 9.8Proof of conceptEPSS 17%
- Pre-auth
- Auth bypass
aveva · indusoft web studioFeb 12, 2019
CVE-2011-3143
42Plan
Use-after-free vulnerability in Control Microsystems ClearSCADA 2005, 2007, and 2009 before R2.3 and R1.4, as used in SCX before 67 R4.5 and
CriticalCVSS 10.0No exploitEPSS 8%
- pre-auth RCE
aveva · clearscadaAug 16, 2011
CVE-2018-10628
41Plan
AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a
CriticalCVSS 9.8No exploitEPSS 5%
- pre-auth RCE
- Memory safety
aveva · intouch 2014Jul 24, 2018
CVE-2018-17914
40Plan
InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2.
CriticalCVSS 9.8No exploitEPSS 5%
- Pre-auth
aveva · indusoft web studioNov 2, 2018
CVE-2018-10620
40Plan
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully cra
CriticalCVSS 9.8No exploitEPSS 4%
- Pre-auth
- Memory safety
aveva · indusoft web studioJul 19, 2018
CVE-2018-17916
40Plan
InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2.
CriticalCVSS 9.8No exploitEPSS 4%
- Pre-auth
- Memory safety
aveva · indusoft web studioNov 2, 2018
CVE-2020-13501
40Plan
An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.
CriticalCVSS 9.8No exploitEPSS 3%
- Pre-auth
- SQL injection
aveva · edna enterprise data historianSep 24, 2020
CVE-2020-13500
40Plan
SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.
CriticalCVSS 9.8No exploitEPSS 3%
- Pre-auth
- SQL injection
aveva · edna enterprise data historianSep 24, 2020
CVE-2020-13499
40Plan
An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.
CriticalCVSS 9.8No exploitEPSS 3%
- Pre-auth
- SQL injection
aveva · edna enterprise data historianSep 24, 2020
CVE-2017-5158
40Plan
An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- Info leak
aveva · wonderware intouch access anywhereApr 20, 2017
CVE-2025-61937
40Plan
AVEVA Process Optimization Code Injection
CriticalCVSS 10.0No exploitEPSS 2%
- pre-auth RCE
aveva · process optimizationJan 15, 2026
CVE-2020-13504
39Monitor
Parameter AttFilterValue in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
aveva · edna enterprise data historianSep 24, 2020
CVE-2020-13505
39Monitor
Parameter psClass in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
aveva · edna enterprise data historianSep 24, 2020
CVE-2021-33008
39Monitor
AVEVA System Platform Missing Authentication for Critical Function
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
aveva · system platformApr 4, 2022
CVE-2021-42796
39Monitor
An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticate
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Command injection
aveva · edgeDec 15, 2023
CVE-2022-1467
39Monitor
AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere
CriticalCVSS 9.9No exploitEPSS 1%
- RCE
aveva · intouch access anywhereMay 23, 2022
CVE-2021-32959
39Monitor
AVEVA SuiteLink Server Buffer Overflow
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Memory safety
aveva · suitelinkSep 23, 2021
CVE-2023-1256
39Monitor
The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
aveva · aveva plant scadaMar 16, 2023
CVE-2025-61943
37Monitor
AVEVA Process Optimization SQL Injection
CriticalCVSS 9.3No exploitEPSS 0%
- SQL injection
- Local privilege escalation
aveva · process optimizationJan 15, 2026
CVE-2025-64691
37Monitor
AVEVA Process Optimization Code Injection
CriticalCVSS 9.3No exploitEPSS 0%
- RCE
- Local privilege escalation
aveva · process optimizationJan 15, 2026
CVE-2025-65118
37Monitor
AVEVA Process Optimization Uncontrolled Search Path Element
CriticalCVSS 9.3No exploitEPSS 0%
- RCE
- Local privilege escalation
aveva · process optimizationJan 15, 2026
CVE-2022-28685
36Monitor
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802
HighCVSS 7.8No exploitEPSS 17%
- RCE
- Deserialization
aveva · aveva edgeMar 29, 2023
CVE-2019-6525
35Monitor
AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and i
HighCVSS 8.8No exploitEPSS 1%
- Info leak
aveva · wonderware system platformApr 11, 2019
CVE-2017-5156
35Monitor
A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior.
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
- CSRF
aveva · wonderware intouch access anywhereApr 20, 2017