The vulnerability enables an attacker who holds Event Log Reader privileges to extract proxy connection details, including URLs and credentials, from PI to CONNECT Agent event log files. This exposure of authentication information in logs allows the attacker to gain unauthorized access to the proxy service. Based on the description, it is inferred that this unauthorized access could provide a pathway for further lateral movement or data exfiltration. The flaw is an instance of information disclosure through log files (CWE-532) and does not provide direct code execution or denial‑of‑service capabilities.

The affected product is AVEVA PI to CONNECT Agent. All versions prior to v2.5.2790 are vulnerable and can be remediated by upgrading to the latest agent release, available from the CONNECT Data Services Portal.

The CVSS score of 5.7 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local or compromised Event Log Reader rights (S-1-5-32-573), implying that an internal threat actor or attacker who has obtained such privileges could leverage the exposed proxy credentials. Because the attack vector is limited to users with log‑reading access, the risk is relatively contained compared to remote code execution vulnerabilities.