Skip to main content

CISA issues alert on AVEVA Edge cryptographic vulnerability allowing local password brute forcing

Source Decision Insights Threat Desk Published November 27, 2025 Companies 1
Human View Machine View

344th article in the last 90 days, one of 454 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues advisory on Opto 22 GRV-EPIC and groov RIO vulnerabilities (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Practitioner
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / Software / Design & Creative Software

Our classification, not the publisher's statement. Best suited for, not only for.

AVEVA Edge, a HMI/SCADA software, contains a vulnerability involving the use of a weak cryptographic algorithm, which can expose user passwords to brute-force extraction by local attackers. This security issue affects AVEVA Edge versions 2023 R2 and earlier, potentially compromising authentication credentials stored within project and offline cache files.

The vulnerability is identified as CVE-2025-9317 and pertains to the use of broken or risky cryptographic algorithms as defined by CWE-327. Exploitation requires read access to Edge Project and Offline Cache files, enabling attackers to computationally brute force app-native or Active Directory passwords protected by weak hashes. The Common Vulnerability Scoring System (CVSS) has assigned this flaw a base score of 8.4 under version 3.1, with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, and a base score of 8.3 under version 4.0, with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N.

The vulnerability could allow attackers to reverse engineer user passwords from the extracted cryptographic material, posing a risk to credential confidentiality. This risk arises specifically when unauthorized parties gain local read access to the specified files.

To address this issue, AVEVA released an update labeled 2023 R2 P01, which introduces a revised password hashing algorithm and requires migration of project files to this new format. The migration process is unidirectional, preventing rollback to previous versions. AVEVA advises organizations to evaluate the applicability of the update in their environments, migrate project files where possible, restrict read permissions on unupgraded files, and mandate password changes for users. No remediation for older project file backups or transient copies is provided beyond access control enforcement.

CISA suggests minimizing exposure of control system devices by restricting network access, isolating these systems behind firewalls, and employing secure remote access methods like virtual private networks, while acknowledging potential Virtual Private Network (VPN) vulnerabilities. Defensive measures should be based on thorough risk assessments. Additional recommendations include enforcing strict access control lists on project file directories, maintaining chain-of-custody for files, applying data protection with strong master passwords, and avoiding embedding passwords directly in project scripts by using project tags instead. Organizations are encouraged to monitor for and report suspicious activity according to established procedures.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-aveva-edge-cryptographic-vulnerability-allowing-local-password-brute-forcing/",
        "name": "CISA issues alert on AVEVA Edge cryptographic vulnerability allowing local password brute forcing",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-aveva-edge-cryptographic-vulnerability-allowing-local-password-brute-forcing/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@type": "Organization",
      "name": "AVEVA"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Practitioner"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / Software / Design & Creative Software"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-24T09:56:23-06:00",
    "datePublished": "2025-11-27T13:30:02-07:00",
    "description": "CISA details a cryptographic vulnerability in AVEVA Edge allowing local attackers to brute force passwords; updating to 2023 R2 P01 mitigates risk.",
    "headline": "CISA issues alert on AVEVA Edge cryptographic vulnerability allowing local password brute forcing",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-03"
    },
    "keywords": [
      "Access Control",
      "Antivirus Software",
      "Common Vulnerability Scoring System",
      "Edge",
      "Password",
      "Virtual Private Network",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-aveva-edge-cryptographic-vulnerability-allowing-local-password-brute-forcing/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-24",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages