CVE-2023-6132: AVEVA Edge products Uncontrolled Search Path Element

Published Feb 29, 2024

Updated

The vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege escalation by tricking AVEVA Edge to load an unsafe DLL.

Affected Software

14 affected components

AVEVA Edge

All of the following

Any of the following

AVEVA Platform Common Services=4.4.6

AVEVA Platform Common Services=4.5.0

AVEVA Platform Common Services=4.5.1

AVEVA Platform Common Services=4.5.2

Any of the following

AVEVA Batch Management=2020

AVEVA Enterprise Data Management=2021

AVEVA Manufacturing Execution System=2020

AVEVA Mobile Operator=2020

AVEVA System Platform=2020

AVEVA System Platform=2020-r2

AVEVA System Platform=2020-r2_p01

AVEVA Work Tasks=2020

AVEVA Work Tasks=2020-update_1

Remediation

Information

AVEVA recommends users upgrade to AVEVA Edge 2023, or AVEVA Edge 2020 R2 SP2 P01 as soon as possible. Upgrades can be downloaded from the AVEVA official website: AVEVA Edge 2023 https://softwaresupportsp.aveva.com/#/producthub/details , AVEVA Edge 2020 R2 SP2 P01 https://softwaresupportsp.aveva.com/#/producthub/details . * Note: Log-in is required. For additional information, please refer to AVEVA's security advisory AVEVA-2024-002. https://www.aveva.com/en/support-and-success/cyber-security-updates/

Event History

Feb 29, 2024

CVE Published

via MITRE·05:40 PM

Data Sourced

via MITRE·05:40 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-6132?

CVE-2023-6132 is classified as a critical vulnerability due to its potential for arbitrary code execution and privilege escalation.

How do I fix CVE-2023-6132?

To mitigate CVE-2023-6132, users should update to the latest version of AVEVA Edge that addresses this vulnerability.

What type of attack does CVE-2023-6132 enable?

CVE-2023-6132 enables a malicious entity to execute arbitrary code and potentially escalate privileges on affected systems.

Which software is impacted by CVE-2023-6132?

CVE-2023-6132 affects the AVEVA Edge software, which is used in various industrial control systems.

Can CVE-2023-6132 lead to system compromise?

Yes, if exploited, CVE-2023-6132 can lead to a complete system compromise through unauthorized code execution.