What is the severity of CVE-2021-42796?

CVE-2021-42796 has a severity rating of critical due to the potential for unauthorized command execution.

How do I fix CVE-2021-42796?

To fix CVE-2021-42796, upgrade to a later version of AVEVA Edge that addresses this vulnerability.

What versions of AVEVA Edge are affected by CVE-2021-42796?

CVE-2021-42796 affects AVEVA Edge versions R2020 and prior.

Can CVE-2021-42796 be exploited remotely?

Yes, CVE-2021-42796 can be exploited remotely as it allows unauthenticated command execution.

What type of attack is possible with CVE-2021-42796?

CVE-2021-42796 allows for arbitrary command execution, which can lead to system compromise.

Vulnerability/
CVE-2021-42796

critical

9.8

CWE

284 78

16/12/2023

7/10/2024

CVE-2021-42796: OS Command Injection

First published: Sat Dec 16 2023(Updated: )

An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
AVEVA Edge
AVEVA Edge 2020 R2 SP1
AVEVA InduSoft Web Studio
AVEVA Edge 2020 R2 SP1	<2020
AVEVA Edge 2020 R2 SP1	=2020
AVEVA Edge 2020 R2 SP1	=2020-r2
AVEVA Edge 2020 R2 SP1	=2020-r2

Never miss a vulnerability like this again

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

ICSA-22-326-01

Frequently Asked Questions

What is the severity of CVE-2021-42796?
CVE-2021-42796 has a severity rating of critical due to the potential for unauthorized command execution.
How do I fix CVE-2021-42796?
To fix CVE-2021-42796, upgrade to a later version of AVEVA Edge that addresses this vulnerability.
What versions of AVEVA Edge are affected by CVE-2021-42796?
CVE-2021-42796 affects AVEVA Edge versions R2020 and prior.
Can CVE-2021-42796 be exploited remotely?
Yes, CVE-2021-42796 can be exploited remotely as it allows unauthenticated command execution.
What type of attack is possible with CVE-2021-42796?
CVE-2021-42796 allows for arbitrary command execution, which can lead to system compromise.

agent/references
agent/type
agent/first-publish-date
agent/author
agent/severity
agent/description
agent/event
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/weakness
agent/trending
agent/source
agent/tags
collector/ics-cert-advisory
source/ICS
agent/software-canonical-lookup
agent/software-canonical-lookup-request
collector/nvd-api
source/NVD
vendor/aveva
canonical/aveva edge
canonical/aveva edge 2020 r2 sp1
canonical/aveva indusoft web studio
version/aveva edge 2020 r2 sp1/2020
version/aveva edge 2020 r2 sp1/2020-r2

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.