Lucene search

MitreCVE-2021-42796

HistoryDec 16, 2023 - 1:15 a.m.

CVE-2021-42796

2023-12-1601:15:07

mitre

web.nvd.nist.gov

cve

2021

42796

executecommand

aveva edge

indusoft web studio

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.001

Percentile

39.1%

JSON

An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.

Affected configurations

Nvd

Node

avevaedgeRange<2020

avevaedgeMatch2020-

avevaedgeMatch2020r2-

avevaedgeMatch2020r2sp1

VendorProductVersionCPE
avevaedge*cpe:2.3:a:aveva:edge:*:*:*:*:*:*:*:*
avevaedge2020cpe:2.3:a:aveva:edge:2020:-:*:*:*:*:*:*
avevaedge2020cpe:2.3:a:aveva:edge:2020:r2:-:*:*:*:*:*
avevaedge2020cpe:2.3:a:aveva:edge:2020:r2:sp1:*:*:*:*:*

Vendor	Product	Version	CPE
aveva	edge	*	cpe:2.3:a:aveva:edge::::::::
aveva	edge	2020	cpe:2.3:a:aveva:edge:2020:-::::::
aveva	edge	2020	cpe:2.3:a:aveva:edge:2020:r2:-:::::*
aveva	edge	2020	cpe:2.3:a:aveva:edge:2020:r2:sp1:::::*

References

www.aveva.com/en/products/edge/

www.cisa.gov/news-events/ics-advisories/icsa-22-326-01

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.001

Percentile

39.1%

JSON

Related for CVE-2021-42796