CVE-2025-9317
published 2025-11-15CVE-2025-9317: The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users'…
PriorityP342high8.4CVSS 3.1
AVLACLPRLUINSCCHIHAN
EPSS
0.09%
0.4th percentile
The vulnerability, if exploited, could allow a miscreant with read
access to Edge Project files or Edge Offline Cache files to reverse
engineer Edge users' app-native or Active Directory passwords through
computational brute-forcing of weak hashes.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aveva | edge | <= Versions 2023 R2 | — |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
nvdv4.08.3HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Schneider Electric EcoStruxure Machine SCADA Expert & Pro-face BLUE Open Studio
cisa_ics·2025-11-18·CVSS 8.4
[HIGH] Schneider Electric EcoStruxure Machine SCADA Expert & Pro-face BLUE Open Studio
ICS Advisory
##
Schneider Electric EcoStruxure Machine SCADA Expert & Pro-face BLUE Open Studio
Release DateNovember 18, 2025
Alert CodeICSA-25-322-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.3
- ATTENTION: Low Attack Complexity
- Vendor: Schneider Electric
- Equipment: EcoStruxure Machine SCADA Expert & Pro-face BLUE Open Studio
- Vulnerability: Use of a Broken or Risky Cryptographic Algorithm
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could lead to loss of confidentiality and integrity.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Schneider Electric reports that the following products use an affected AVEVA component:
- EcoStruxur
CISA ICS
AVEVA Edge
cisa_ics·2025-11-13·CVSS 8.4
[HIGH] AVEVA Edge
ICS Advisory
##
AVEVA Edge
Release DateNovember 13, 2025
Alert CodeICSA-25-317-03
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.3
- ATTENTION: Low attack complexity
- Vendor: AVEVA
- Equipment: Edge
- Vulnerability: Use of a Broken or Risky Cryptographic Algorithm
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow a local attacker to reverse engineer passwords through brute force.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of AVEVA Edge (formerly InduSoft Web Studio), a HMI/SCADA software, are affected:
- Edge: Versions 2023 R2 and prior
## 3.2 VULNERABILITY OVERVIEW
## 3.2.1 USE OF A BROKEN OR RISKY CRYPT
GHSA
GHSA-hgj3-cggc-7jc2: The vulnerability, if exploited, could allow a miscreant with read
access to Edge Project files or Edge Offline Cache files to reverse
engineer Edge u
ghsa_unreviewed·2025-11-15
CVE-2025-9317 [HIGH] CWE-327 GHSA-hgj3-cggc-7jc2: The vulnerability, if exploited, could allow a miscreant with read
access to Edge Project files or Edge Offline Cache files to reverse
engineer Edge u
The vulnerability, if exploited, could allow a miscreant with read
access to Edge Project files or Edge Offline Cache files to reverse
engineer Edge users' app-native or Active Directory passwords through
computational brute-forcing of weak hashes.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-15
Published