CVE-2025-44019

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service. Depending on the timing of the crash, data present in snapshots/write cache may be lost.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-248

Affected software

Vendor	Product	Versions
AVEVA	PI Data Archive	<= 2018 SP3 Patch 4
AVEVA	PI Data Archive	2023
AVEVA	PI Data Archive	2023 Patch 1
AVEVA	PI Server	<= 2018 SP3 Patch 6
AVEVA	PI Server	2023
AVEVA	PI Server	2023 Patch 1

References

Timeline

Published: Jun 12, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-440212.8OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the CVE-2025-440229.8An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism.CVE-2025-440236.5An issue in dlink DNS-320 v.1.00 and DNS-320LW v.1.01.0914.20212 allows an attacker to execute arbitrary via the account_mgr.cgi->cgi_chg_ad CVE-2025-440246.1Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficien CVE-2025-44039.8The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, a CVE-2025-440339.8SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declara CVE-2025-440348.0SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/CVE-2025-440395.1CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability a CVE-2025-44049.1A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniquen CVE-2025-440407.2An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication d CVE-2025-440435.4Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery (SSRF) in /Keyoti_SearchEngine_Web_Common/SearchService.svc/G CVE-2025-440447.5Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can force a vulnerable SearchUnit host into pa