- Description
- The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the model application server.
- Source
- ics-cert@hq.dhs.gov
- NVD status
- Analyzed
- Products
- process_optimization
CVSS 4.0
- Type
- Secondary
- Base score
- 10
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- CRITICAL
CVSS 3.1
- Type
- Secondary
- Base score
- 10
- Impact score
- 6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- ics-cert@hq.dhs.gov
- CWE-94
- Hype score
- Not currently trending
🚨 Critical AVEVA Process Optimization Flaws Enable Unauthenticated SYSTEM-Level RCE Seven vulnerabilities in AVEVA Process Optimization (ROMeo) 2024.1 and earlier include a CVSS 10.0 API-layer code injection bug (CVE-2025-61937) that allows unauthenticated attackers to execute
@ThreatSynop
20 Jan 2026
64 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
産業制御ソフトAVEVA Process Optimization（旧ROMeo）にCVSSv4スコア10の脆弱性。CVE-2025-61937は標準ユーザーがAPI経由で任意コード実行可能なもの。CVSSスコア9.3の他脆弱性3件と併せ修正。 https://t.co/Id3mcSUV4S
@__kokumoto
20 Jan 2026
259 Impressions
0 Retweets
2 Likes
0 Bookmarks
1 Reply
0 Quotes
🚨 New Critical CVE: CVE-2025-61937 📊 Score: 10.0 📝 The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution un... 🔗 Read Details: https://t.co/4ryfI5zf5B #CVE #CyberSecurity #WatchStack
@watchstackio
16 Jan 2026
4 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aveva:process_optimization:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6048CC3D-EA33-484F-9223-10632815D595",
"versionEndExcluding": "2025",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]