CVE-2025-64691 is a critical vulnerability identified in AVEVA Process Optimization software, which is widely used in industrial process management and optimization. The flaw is categorized under CWE-94, indicating that it involves improper control of code injection, specifically related to TCL Macro scripts within the application. An authenticated user with standard OS-level privileges can exploit this vulnerability to tamper with these TCL scripts. By modifying the scripts, the attacker can escalate their privileges from a standard user to system-level access on the underlying operating system. This escalation effectively grants full control over the model application server hosting the AVEVA Process Optimization software. The vulnerability does not require user interaction and has a low attack complexity, but it does require the attacker to have valid authentication credentials with at least standard user privileges. The CVSS v3.1 base score of 8.8 reflects the high impact on confidentiality, integrity, and availability, as a successful exploit could lead to complete system compromise. Although no public exploits are currently known, the nature of the vulnerability suggests that once exploited, attackers could execute arbitrary code, manipulate critical process optimization data, disrupt industrial operations, or use the compromised server as a pivot point for further attacks within the network. The lack of available patches at the time of disclosure increases the urgency for organizations to implement interim mitigations and monitor for suspicious activity related to TCL script modifications and privilege escalations.

For European organizations, particularly those in manufacturing, energy, and industrial sectors relying on AVEVA Process Optimization, this vulnerability poses a significant risk. Successful exploitation could lead to unauthorized control over critical process optimization systems, resulting in operational disruptions, data integrity loss, and potential safety hazards. The compromise of model application servers could also facilitate lateral movement within corporate networks, exposing sensitive intellectual property and operational data. Given Europe's strong industrial base and reliance on process optimization technologies, the impact could extend to supply chain interruptions and financial losses. Additionally, regulatory compliance risks arise if data confidentiality or system availability is compromised, potentially leading to fines under GDPR or sector-specific regulations. The vulnerability's exploitation could also undermine trust in industrial control systems and affect national critical infrastructure, especially in countries with significant manufacturing and energy production capabilities.

1. Restrict access to AVEVA Process Optimization systems strictly to authorized personnel with a need-to-know basis, minimizing the number of users with standard OS-level privileges. 2. Implement robust authentication mechanisms, including multi-factor authentication, to reduce the risk of credential compromise. 3. Monitor and audit TCL Macro script files for unauthorized changes or tampering, employing file integrity monitoring solutions tailored to these scripts. 4. Apply network segmentation to isolate the model application servers from less trusted network zones, limiting lateral movement opportunities. 5. Employ application whitelisting to prevent unauthorized execution or modification of TCL scripts. 6. Regularly review and harden operating system security configurations on servers hosting AVEVA Process Optimization. 7. Engage with AVEVA for timely updates and patches; until patches are available, consider temporary disabling or restricting TCL Macro functionality if feasible. 8. Conduct user training to raise awareness about the risks of privilege escalation and the importance of safeguarding credentials. 9. Prepare incident response plans specifically addressing potential exploitation scenarios involving AVEVA Process Optimization. 10. Utilize endpoint detection and response (EDR) tools to detect anomalous behaviors indicative of privilege escalation or script tampering.