medium5.3
CVE-2021-42794
An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior.
Impact
An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a malicious connection string that could allow an adversary to port scan the LAN, depending on the hosts' responses.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Aveva | Edge | before 2020 Version 2020 |
References
- NVD record
- CVE.org record
- https://www.aveva.com/en/products/edge/
- https://www.cisa.gov/news-events/ics-advisories/icsa-22-326-01
- https://www.exploit-db.com/docs/english/17254-connection-string-parameter-pollution-attacks.pdf
- https://www.aveva.com/en/products/edge/
- https://www.cisa.gov/news-events/ics-advisories/icsa-22-326-01
- https://www.exploit-db.com/docs/english/17254-connection-string-parameter-pollution-attacks.pdf