CVE-2021-42796

The command injection vulnerability is located in the ExecuteCommand() function of AVEVA Edge software. An attacker can remotely, without needing any credentials, submit properly crafted input data that is passed to this function without proper validation or sanitization. As a result, malicious commands are executed directly in the context of the operating system on which the application runs.

An attacker can gain full control over the target system — read or modify data, install malicious software, and cause service unavailability. In industrial environments (ICS/SCADA), the effects may include disruption of operational processes.

Apply patches available from the manufacturer according to references (CISA ICS-CERT advisory: ICSA-22-326-01 and AVEVA manufacturer information). It is recommended to immediately update to a version newer than R2020 and restrict network access to AVEVA Edge systems according to the principle of least privilege.

AVEVA Edge (formerly InduSoft Web Studio) in versions R2020 and earlier.