Industrial Alert: Critical RCE in AVEVA Software Rated CVSS 10

AVEVA issued a critical security bulletin for Process Optimization (formerly ROMeo) disclosing multiple high-severity vulnerabilities—most notably CVE-2025-61937, an unauthenticated RCE (CVSS 10.0) in the API that can allow remote OS-level compromise of the Model Application Server. Additional issues include macro tampering, SQL injection, DLL hijacking, cleartext transmission, and missing access controls; AVEVA advises immediate upgrade to version 2025 or applying strict mitigations (restricting taoimr service access, locking folders, and protecting project files) until patched.