AVEVA Edge 2020 R2 SP1 and all prior versions

🗓️ 06 Sep 2022 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 77 Views

AVEVA Edge 2020 R2 SP1 and prior versions have insufficient UI warning, uncontrolled search path, deserialization of untrusted data, and improper restriction of XML external entity reference leading to arbitrary code execution, information disclosure, and denial of service

Reporter	Title	Published	Views	Family All 76
BDU FSTEC	The vulnerability of the AVEVA Edge SCADA system, related to the restoration of unreliable data in memory, allows a intruder to execute arbitrary code.	22 Aug 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the AVEVA Edge SCADA system, related to the uncontrolled element in the search process, allows a intruder to execute arbitrary commands or increase their privileges.	22 Aug 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the AVEVA Edge SCADA system, related to the uncontrolled element in the search process, allows a intruder to execute arbitrary commands or increase their privileges.	22 Aug 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the AVEVA Edge SCADA system, related to the uncontrolled element in the search process, allows a intruder to execute arbitrary commands or increase their privileges.	22 Aug 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the AVEVA Edge SCADA system, related to incorrect restrictions on XML references to external objects, allows a intruder to trigger a service failure or gain unauthorized access to confidential data.	22 Aug 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the SCADA system AVEVA Edge’s script creation function, related to insufficient warning for dangerous actions, allows a violator to execute arbitrary code.	22 Aug 202200:00	–	bdu_fstec
Circl	CVE-2022-28685	29 Mar 202322:16	–	circl
Circl	CVE-2022-28686	18 Feb 202521:11	–	circl
Circl	CVE-2022-28687	18 Feb 202521:11	–	circl
Circl	CVE-2022-28688	18 Feb 202521:11	–	circl

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-249-02.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-22-249-02
cisa	www.cisa.gov/news-events/ics-advisories/icsa-22-249-02
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

06 Sep 2022 00:00Current

7.8High risk

Vulners AI Score7.8

CVSS 3.17.8

CVSS 37.8

EPSS0.17157

SSVC