AVEVA Enterprise SCADA Deserialization Flaw Hits 2021, 2025 Versions
The four-year version span and the mandatory shift from binary to JSON serialization, even for patched systems, suggest AVEVA's serializer architecture is the underlying problem, not a single coding error.
TL;DR
CISA published an advisory for CVE-2025-7639, a deserialization vulnerability in AVEVA Enterprise SCADA affecting every major version from 2021 through 2025. An authenticated user with "DNA Authority, Operator" privilege can tamper with serialized data to execute code under the SCADA security group "DNA Apps." Mitigation isn't a simple download: organizations must contact AVEVA support for version-specific patches and then manually reconfigure the binary serializer from Binary Formatter to JSON mode across all server and client nodes. The four-year version spread means primes who haven't recently inventoried their SCADA deployments may be running vulnerable instances they've lost track of.
CISA's advisory for CVE-2025-7639 covers AVEVA Enterprise SCADA versions from 2021 through 2025, a span that makes clear this isn't a regression introduced in a recent release. The vulnerability sits in the deserialization path: an authenticated user holding "DNA Authority, Operator" rights can tamper with serialized data, and when the system deserializes it, the payload executes under the "DNA Apps" security group. CVSS v3.1 lands at 7.1 (HIGH), with the attack complexity rated high, but complexity here refers to the exploit chain, not the exposure surface. Every organization running unpatched Enterprise SCADA in critical manufacturing or defense-industrial-base environments is in scope.
The mitigation path has two layers, and skipping either one leaves the system exposed. First, organizations must contact AVEVA support to obtain version-specific patches, there's no public download link, no self-serve portal. The advisory lists separate patch versions for each affected release train: 2025 P1, 2024 SP1 P2, 2023 SP1 P1, 2022 SP2 P3, 2021 SP2 P6, plus corresponding HMI client updates. Second, after every server and client node is patched, operators must reconfigure the BinarySerializer to switch from "Binary Formatter" mode to JSON and set "AcceptBinaryFormattedData" to false. This second step is mandatory for full mitigation.
That configuration requirement is the tell. AVEVA isn't just fixing a bug; it's deprecating the binary serialization format that created the vulnerability surface in the first place. The fact that the serializer mode is a toggle, not a code rewrite, implies the architecture supported JSON serialization all along. Organizations that applied earlier patches without changing this configuration may have been running with the vulnerable binary formatter active for years without knowing it.
The advisory also requires HMI display migration and re-caching of XOS Event Handlers assemblies across all nodes, operational steps that mean this isn't a patch-you-can-apply-during-a-maintenance-window-and-forget fix. AVEVA's reference architecture documentation and the associated knowledge base article (KB117814) walk through the step-by-step process, but the coordination burden is significant: servers, clients, and HMI nodes must all reach compatible patch levels before the serializer configuration can be flipped. Organizations that stagger their patching cycles across different system tiers will need to plan the sequencing carefully to avoid a state where some nodes reject connections from others due to serializer mismatches. For operators where SCADA downtime is infeasible, the advisory doesn't answer whether the configuration change alone (switching to JSON without patching) provides sufficient mitigation. The language treats patch and configuration as a package deal, but in practice, operators will ask.
The broader pattern deserves attention. This is at least the fourth CISA advisory for an AVEVA product involving deserialization or serialization-path vulnerabilities since 2023, following advisories for PI Web API (CVE-2024-3468, also CWE-502, per ICSA-24-163-02) and Plant SCADA (CVE-2023-1256, CVSS 9.8, per ICSA-23-073-04), and Edge products. For primes and defense contractors subject to DFARS 7012 or CMMC requirements, the cumulative exposure across multiple AVEVA product lines raises a compliance question that goes beyond patching this single CVE: if the serializer architecture has been a recurring weakness, has the organization's SCADA inventory been kept current enough to know which instances are affected by which advisories?
Published ·Deep Fathom