AVEVA Patches a Hardcoded Encryption Key in Pipeline Software
Security / news
AVEVA Patches a Hardcoded Encryption Key in Pipeline Software
One PIMBoards flaw hands over project files protected by a key baked into the software; a second relied on MD5 to hash the passwords guarding them.
Anyone with read access to a project file from AVEVA's Pipeline Integrity Monitor can decrypt its contents, because the software protects those files with an encryption key that is the same in every installation, according to a CISA advisory published Thursday.
The advisory, ICSA-26-253-01, covers four vulnerabilities in the PIMBoards component of Pipeline Integrity Monitor, a tool AVEVA sells to help pipeline operators detect and respond to leaks in midstream oil and gas lines. All affected versions are 2025 SP1 P1 build 7.1.9580.8513 and earlier; AVEVA's fix is the 2025 SP1 P2 security update, which the advisory says also requires migrating old project files to take effect.
The two high-severity bugs share a root cause
CVE-2026-81821 and CVE-2026-81822 both score 8.4 on CVSS 3.1 and both require an attacker to have read access to PIMBoards project files, a bar CISA notes is lower than remote exploitation but still meaningful on a shared engineering workstation or a poorly segmented network share. CVE-2026-81821 is the hardcoded cryptographic key itself, tracked under CWE-321. CVE-2026-81822 compounds it: PIMBoards hashes the user credentials stored in those same files with MD5, a broken algorithm that lets an attacker who already has the files brute-force the passwords offline and, CISA says, potentially reach administrator level inside the component.
Two lower-severity flaws came through a bug bounty
The advisory credits Adham Khairy, a penetration tester and bug bounty hunter who publishes under the handle 0xadham, with reporting CVE-2026-81823 and CVE-2026-81824 through HackerOne. CVE-2026-81823, rated 5.3, is a missing-authorization flaw that needs no authentication at all. CVE-2026-81824, rated 4.7, is a cross-site scripting bug that requires tricking a user into clicking a malicious link.
| CVE | CVSS 3.1 | Flaw | Reported by |
|---|---|---|---|
| CVE-2026-81821 | 8.4 | Hardcoded encryption key | AVEVA, self-reported |
| CVE-2026-81822 | 8.4 | MD5 password hashing | AVEVA, self-reported |
| CVE-2026-81823 | 5.3 | Missing authorization | Adham Khairy, HackerOne |
| CVE-2026-81824 | 4.7 | Cross-site scripting | Adham Khairy, HackerOne |
Why a leak-detection tool draws this kind of bug
AVEVA lists Pipeline Integrity Monitor under the critical manufacturing sector on its own product page, and CISA's advisory says it is deployed globally. That puts a hardcoded key in the same category of mistake as two other bugs this site covered the same week, in ST Engineering's iDirect satellite terminals and IXON's industrial VPN client: each was a design decision made once, at the factory, that no operator could fix without a vendor update.
The advisory does not say whether AVEVA has evidence of the hardcoded key being extracted or used against a live deployment, only that the risk exists for anyone who can read a project file. Migrating existing project files to the patched format, not just installing the update, is what closes the gap, and AVEVA has not said how many customers have completed that migration.
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.