Measurement Advisor - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/measurement-advisor/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 13 Aug 2026 16:53:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAVEVA Enterprise SCADA Deserialization Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-08-aveva-scada-deserialization/Thu, 13 Aug 2026 16:53:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-aveva-scada-deserialization/Authenticated attackers with operator-level access can exploit a deserialization vulnerability (CVE-2025-7639) in AVEVA Enterprise SCADA to achieve remote code execution.AVEVA has identified a high-severity deserialization vulnerability, tracked as CVE-2025-7639, affecting multiple versions of the AVEVA Enterprise SCADA suite. The vulnerability exists within the application's handling of serialized data, specifically when using the 'Binary Formatter' mode. An authenticated attacker possessing 'DNA Authority - Operator' privileges can manipulate serialized data streams to force the application to execute arbitrary code under the security context of the 'DNA Apps' service group.

This issue impacts a wide range of versions, including the 2025 release and various service packs of the 2021 through 2024 versions. Because this affects critical infrastructure sectors and involves code execution, it poses a significant risk to industrial operations. AVEVA has released security updates and recommended configuration changes, including the migration from Binary Formatter to JSON serialization, to remediate the vulnerability.

Impact

Successful exploitation allows an attacker to achieve remote code execution within the 'DNA Apps' security group context. This could lead to full control over affected SCADA servers and HMI clients, potentially enabling unauthorized process control or disruption of critical manufacturing operations globally.

Recommendation

  • Upgrade all affected Server and Client nodes to the versions specified in AVEVA Security Bulletin AVEVA-2026-005.
  • Implement the recommended configuration changes by updating 'BinarySerializer' mode settings from 'Binary Formatter' to 'JSON' and disabling 'AcceptBinaryFormattedData'.
  • Audit assigned permissions to ensure that only authorized personnel maintain 'DNA Authority - Operator' privileges.
  • Disable any 'BLT Test' clients currently running within production environments as per vendor guidance.
  • Review KB117814 for detailed step-by-step instructions on migration and configuration hardening.
]]>highadvisoryicsscadadeserializationcve-2025-7639