This vulnerability, identified as CWE-321, arises from the use of a hard-coded cryptographic key within AVEVA Pipeline Integrity Monitor. If an attacker gains read access to project files, they can leverage the hard-coded key to decrypt sensitive data stored in those files. The CVSS 4.0 score of 8.3 reflects high impact on confidentiality and system integrity, with low attack complexity and no user interaction required. The vulnerability is local and requires low privileges but can lead to significant data exposure. No known exploits are reported in the wild, and no vendor remediation or patch information is currently available.

Exploitation of this vulnerability could lead to unauthorized decryption and disclosure of sensitive information contained in PIMBoards project files. This compromises confidentiality and could affect the integrity of the data. The attack requires local read access and low privileges but does not require user interaction. There is no indication of privilege escalation or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict read access to PIMBoards project files to trusted users only to reduce the risk of exploitation.