Read the docs
TI-2021-18991 Aliases CVE-2021-42794GHSA-r275-q95r-mr46

An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and…

Priority LOW 26Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a malicious connection string that could allow an adversary to port scan the LAN, depending on the hosts' responses.

Why it matters now

EPSS 0.01199 68th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:aveva:edge:*:*:*:*:*:*:*:*before 2020VulnerableAVEVA
cpe:2.3:a:aveva:edge:2020:-:*:*:*:*:*:*2020VulnerableAVEVA
cpe:2.3:a:aveva:edge:2020:r2:-:*:*:*:*:*2020 r2VulnerableAVEVA
cpe:2.3:a:aveva:edge:2020:r2:sp1:*:*:*:*:*2020 r2VulnerableAVEVA
  • cpe:2.3:a:aveva:edge:*:*:*:*:*:*:*:* Versions before 2020 Vulnerable ·AVEVA
  • cpe:2.3:a:aveva:edge:2020:-:*:*:*:*:*:* Versions 2020 Vulnerable ·AVEVA
  • cpe:2.3:a:aveva:edge:2020:r2:-:*:*:*:*:* Versions 2020 r2 Vulnerable ·AVEVA
  • cpe:2.3:a:aveva:edge:2020:r2:sp1:*:*:*:*:* Versions 2020 r2 Vulnerable ·AVEVA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-42794
  2. 2026-10-03 Alias added: GHSA-r275-q95r-mr46

References

Exploit 1

Advisory 1

Other 1

  • TI-2021-18992 An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio)… CVSS 3.1CRITICAL 9.8
  • TI-2018-12746 InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch… CVSS 3.1CRITICAL 9.8
  • TI-2018-12748 Stack-based buffer overflow in InduSoft Web Studio, and InTouch Edge HMI CVSS 3.1CRITICAL 9.8
  • TI-2023-16745 AVEVA Operations Control Logger Execution with Unnecessary Privileges CVSS 3.1HIGH 7.8
  • TI-2021-18993 Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020… CVSS 3.1HIGH 7.5
  • TI-2023-17471 AVEVA Operations Control Logger External Control of File Name or Path CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences