CVE-2022-28685

Vulnerability

This vulnerability affects AVEVA Edge 2020 SP2 Patch 0 (version 4201.2111.1802.0000). The flaw resides in the parsing of APP files, where the software fails to properly validate user-supplied data, leading to deserialization of untrusted data. This can be triggered when a user opens a malicious APP file or visits a malicious page that loads such a file [1].

Exploitation

An attacker must convince a user to open a specially crafted APP file or navigate to a malicious web page that triggers the parsing. No authentication is required, but user interaction is necessary. The deserialization occurs within the context of the current process, allowing the attacker to execute arbitrary code [1].

Impact

Successful exploitation grants the attacker arbitrary code execution in the context of the current process. This can lead to full compromise of the affected system, including data disclosure, modification, or denial of service, depending on the privileges of the user running the application [1].

Mitigation

No official patch or workaround has been disclosed in the available references. Users are advised to exercise caution when opening APP files from untrusted sources and to restrict access to the affected software until a fix is released [1].