Vulnerabilities

TI-2021-18993 CVE-2021-42797 · GHSA-4wwr-56pj-4v9h

Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020…

LOW 35

Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01 Published 2023-12-16 No fix listed CWE-22

TI-2021-18992 CVE-2021-42796 · GHSA-w96c-3jm7-32vm

An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio)…

MEDIUM 51

An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01133 Published 2023-12-16 No fix listed CWE-78

TI-2021-18991 CVE-2021-42794 · GHSA-r275-q95r-mr46

An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and…

LOW 26

An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01199 Published 2023-12-16 No fix listed

TI-2023-17471 CVE-2023-34982 · GHSA-rv48-qr4w-frqj

AVEVA Operations Control Logger External Control of File Name or Path

LOW 31

This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00219 Published 2023-11-15 No fix listed CWE-73

TI-2023-16745 CVE-2023-33873 · GHSA-6v89-cgp3-2347

AVEVA Operations Control Logger Execution with Unnecessary Privileges

LOW 36

This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in co…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00236 Published 2023-11-15 No fix listed CWE-250

TI-2018-12748 CVE-2018-17916 · GHSA-2fr8-jp4p-fff3

Stack-based buffer overflow in InduSoft Web Studio, and InTouch Edge HMI

MEDIUM 48

InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03733 Published 2018-11-02 No fix listed CWE-121

TI-2018-12746 CVE-2018-17914 · GHSA-xjh8-jwcf-pmgc

InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch…

MEDIUM 49