# AVEVA PI Connector for CygNet XSS and DoS vulnerabilities

Published: 2025-06-12 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/07c0b9d7-4284-5e92-80f3-a36291ff2401/aveva-pi-connector-for-cygnet-xss-and-dos-vulnerabilities

> Two flaws in AVEVA PI Connector for CygNet 1.6.14 allow authenticated attackers to persist malicious code or cause denial of service.

AVEVA PI Connector for CygNet versions 1.6.14 and prior contain two local vulnerabilities requiring high-privilege access to exploit. CVE-2025-4417 is a cross-site scripting flaw that permits an administrative user with local portal access to inject persistent JavaScript executed by other users visiting affected pages, potentially leading to further compromise of the administrative interface. CVE-2025-4418 is an improper integrity validation flaw allowing a privileged user to modify local cache and buffer files, rendering the connector service unresponsive.

Both vulnerabilities require local access and elevated privileges (administrator or PI Connector administrator group membership) to exploit; neither is remotely exploitable. HAVIA has released patch version 1.7.0 and higher to remediate both issues. No active exploitation has been reported to CISA at the time of publication. The product is deployed worldwide in critical manufacturing sectors. Mitigation focuses on access control: restricting PI Connector administrative access to trusted entities, auditing local administrator and PI Connector administrator group membership, and reviewing custom installation folder access control lists.

## Mentioned in this report

- Vulnerabilities: CVE-2025-4417, CVE-2025-4418

## Detection guidance (public sample)

### Member Added to Local PI Connector Administrator Group

ATT&CK: T1190

Flags additions to a local group whose name contains 'PI Connector'. The AVEVA PI Connector for CygNet flaws require membership in this group to exploit, so unexpected additions are a precursor worth auditing. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Member Added to Local PI Connector Administrator Group
description: Detects a member being added to a local security group whose name contains
  'PI Connector' (event 4732). CVE-2025-4417 and CVE-2025-4418 in AVEVA PI Connector
  for CygNet need administrator or PI Connector administrator group rights, so unplanned
  additions to that group are a precursor to abuse. The group name is matched generically
  and may need tuning to the local naming.
tags:
- attack.initial-access
- attack.t1190
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4732
    TargetUserName|contains: PI Connector
  condition: selection
falsepositives:
- Planned onboarding of OT/PI administrators by the change-managed identity team
- Initial product installation or upgrade that provisions the connector admin group
level: medium
id: ba148908-56ef-5f04-bfd5-202877857fa8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09
```

### Non-Connector Process Writing to PI Connector for CygNet Buffer or Cache Files

ATT&CK: T1499.004

Detects files under a CygNet connector buffer/cache location written by a process that is not the connector itself, as in the integrity-validation DoS (CVE-2025-4418). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Non-Connector Process Writing to PI Connector for CygNet Buffer or Cache Files
description: Detects file writes to buffer or cache paths of the PI Connector for
  CygNet by processes that are not part of the connector. CVE-2025-4418 lets a privileged
  local user tamper with these files and make the service unresponsive. The path keywords
  are generic because installation folders can be customised, so tune them to the
  local install path.
tags:
- attack.impact
- attack.t1499.004
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains|all:
    - CygNet
    - PI Connector
    TargetFilename|contains:
    - \buffer
    - \cache
  filter_connector:
    Image|contains:
    - PI Connector
    - CygNet
  condition: selection and not filter_connector
falsepositives:
- Backup or antivirus software touching the connector data folders
- Administrators manually clearing cache or buffer files during support
level: low
id: 7fd2f9e1-fbd0-5ee0-976d-9c6050839326
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/07c0b9d7-4284-5e92-80f3-a36291ff2401/aveva-pi-connector-for-cygnet-xss-and-dos-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup