AVEVA Edge products (formerly known as InduSoft Web Studio)

Summary

Vulnerabilities 1

• High 7.3
  CVE-2023-6132

  AVEVA Edge products Uncontrolled Search Path Element

  The vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege escalation by tricking AVEVA Edge to load an unsafe DLL.

  AVEVA AVEVA Edge Browsers
  Feb 29, 2024

Revision history

1. 2024-02-01 #1

   Initial Publication

References

• ICSA Advisory ICSA-24-032-03 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-03
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B