AVEVA PI Connector for CygNet XSS and DoS vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Two flaws in AVEVA PI Connector for CygNet 1.6.14 allow authenticated attackers to persist malicious code or cause denial of service.
AVEVA PI Connector for CygNet versions 1.6.14 and prior contain two local vulnerabilities requiring high-privilege access to exploit. CVE-2025-4417 is a cross-site scripting flaw that permits an administrative user with local portal access to inject persistent JavaScript executed by other users visiting affected pages, potentially leading to further compromise of the administrative interface. CVE-2025-4418 is an improper integrity validation flaw allowing a privileged user to modify local cache and buffer files, rendering the connector service unresponsive.
Both vulnerabilities require local access and elevated privileges (administrator or PI Connector administrator group membership) to exploit; neither is remotely exploitable. HAVIA has released patch version 1.7.0 and higher to remediate both issues. No active exploitation has been reported to CISA at the time of publication. The product is deployed worldwide in critical manufacturing sectors. Mitigation focuses on access control: restricting PI Connector administrative access to trusted entities, auditing local administrator and PI Connector administrator group membership, and reviewing custom installation folder access control lists.
Mentioned in this report
Detection guidance
Member Added to Local PI Connector Administrator Group
Flags additions to a local group whose name contains 'PI Connector'. The AVEVA PI Connector for CygNet flaws require membership in this group to exploit, so unexpected additions are a precursor worth auditing. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Member Added to Local PI Connector Administrator Group
description: Detects a member being added to a local security group whose name contains
'PI Connector' (event 4732). CVE-2025-4417 and CVE-2025-4418 in AVEVA PI Connector
for CygNet need administrator or PI Connector administrator group rights, so unplanned
additions to that group are a precursor to abuse. The group name is matched generically
and may need tuning to the local naming.
tags:
- attack.initial-access
- attack.t1190
logsource:
product: windows
service: security
detection:
selection:
EventID: 4732
TargetUserName|contains: PI Connector
condition: selection
falsepositives:
- Planned onboarding of OT/PI administrators by the change-managed identity team
- Initial product installation or upgrade that provisions the connector admin group
level: medium
id: ba148908-56ef-5f04-bfd5-202877857fa8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09
Non-Connector Process Writing to PI Connector for CygNet Buffer or Cache Files
Detects files under a CygNet connector buffer/cache location written by a process that is not the connector itself, as in the integrity-validation DoS (CVE-2025-4418). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Non-Connector Process Writing to PI Connector for CygNet Buffer or Cache Files
description: Detects file writes to buffer or cache paths of the PI Connector for
CygNet by processes that are not part of the connector. CVE-2025-4418 lets a privileged
local user tamper with these files and make the service unresponsive. The path keywords
are generic because installation folders can be customised, so tune them to the
local install path.
tags:
- attack.impact
- attack.t1499.004
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains|all:
- CygNet
- PI Connector
TargetFilename|contains:
- \buffer
- \cache
filter_connector:
Image|contains:
- PI Connector
- CygNet
condition: selection and not filter_connector
falsepositives:
- Backup or antivirus software touching the connector data folders
- Administrators manually clearing cache or buffer files during support
level: low
id: 7fd2f9e1-fbd0-5ee0-976d-9c6050839326
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs