CVE-2022-28686

Vulnerability

The vulnerability exists in AVEVA Edge 2020 SP2 Patch 0 (version 4201.2111.1802.0000) during the handling of APP files. The process loads a library from an unsecured location, which can be controlled by an attacker. This is an uncontrolled search path element vulnerability (CWE-427). [1]

Exploitation

An attacker must convince a user to visit a malicious webpage or open a malicious APP file. No authentication is required, but user interaction is necessary. The attacker can place a malicious library in a location that the application searches before the intended secure location, causing the application to load the attacker's code. [1]

Impact

Successful exploitation allows arbitrary code execution in the context of the current process. The CVSS score is 7.8 (High) with impacts to confidentiality, integrity, and availability. The attacker gains the same privileges as the user running AVEVA Edge. [1]

Mitigation

AVEVA has issued an update to address this vulnerability. Users should apply the latest patch from AVEVA. No workaround is mentioned in the available references. [1]