CVE-2022-28687
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on AVEVA Edge 2020 installations by tricking users into opening malicious APP files. The flaw exists in how the software loads libraries from unsecured locations, enabling code execution in the current process context. Only users running the specific affected version are vulnerable.
💻 Affected Systems
- AVEVA Edge 2020
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Attacker gains control of the AVEVA Edge process, allowing them to execute commands, access system resources, and potentially escalate privileges.
If Mitigated
Limited impact with proper application whitelisting, network segmentation, and user training preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction but is technically straightforward once malicious file is executed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version beyond 4201.2111.1802.0000
Vendor Advisory: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf
Restart Required: Yes
Instructions:
1. Download latest AVEVA Edge update from official vendor portal. 2. Backup current configuration. 3. Install update following vendor instructions. 4. Restart system and verify version.
🔧 Temporary Workarounds
Restrict APP file execution
windowsBlock execution of APP files via application control or group policy
Using Windows AppLocker: New-AppLockerPolicy -RuleType Path -Action Deny -Path "*.app" -Name "Block APP files"
Remove vulnerable version
windowsUninstall affected version if not required for operations
Control Panel > Programs > Uninstall AVEVA Edge 2020
🧯 If You Can't Patch
- Implement strict application whitelisting to prevent unauthorized executables
- Train users to never open APP files from untrusted sources and disable automatic file associations
🔍 How to Verify
Check if Vulnerable:
Check AVEVA Edge version in Help > About. If version is exactly 4201.2111.1802.0000, system is vulnerable.Check Version:
Check Help > About in AVEVA Edge application interfaceVerify Fix Applied:
Verify version has changed from 4201.2111.1802.0000 after update installation.📡 Detection & Monitoring
Log Indicators:
- Process creation events from AVEVA Edge loading unexpected DLLs
- APP file execution in process logs
Network Indicators:
- Unexpected outbound connections from AVEVA Edge process
- Downloads of APP files from external sources
SIEM Query:
ProcessName="AVEVA Edge" AND (FileName="*.app" OR CommandLine CONTAINS ".app")🔗 References
- https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-22-1126/
- https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-22-1126/
