Paper/Archive/CVE-2021-42796

CVE-2021-42796

mitre — An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthentic…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 66.5.665 × 2013.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refaveva.com/en/products/edge refcisa.gov/news-events/ics-advisories/icsa-22-326-01