MEDIUM🇵🇱 Wersja polska

CVE-2021-42794

CVSS 5.3v3.1pub. 2023-12-16upd. 2024-11-21

An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a malicious connection string that could allow an adversary to port scan the LAN, depending on the hosts' responses.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

  • Aveva Edge

    APP
    Aveva
    2020< 2020
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-42796CRITICAL9.8PL ✓same product

AVEVA Edge: nieuwierzytelnione zdalne wykonanie poleceń (RCE) w ExecuteCommand()

CVE-2018-17914CRITICAL9.8PL ✓same product

RCE bez uwierzytelnienia w Aveva InduSoft Web Studio i InTouch Edge HMI

CVE-2018-17916CRITICAL9.8PL ✓same product

Stack-based buffer overflow i RCE w Aveva InduSoft Web Studio i InTouch Edge HMI

CVE-2021-42797HIGH7.5same product

Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an u...

CVE-2023-33873HIGH7.8same product

This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standar...