CVE-2022-28686 in Edge
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17114.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/20/2026
CVE-2022-28686 represents a critical remote code execution vulnerability affecting AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000) installations. This vulnerability stems from insecure library loading practices within the application's handling of APP files, creating a pathway for attackers to escalate privileges and execute malicious code. The flaw specifically manifests when the application loads libraries from unsecured locations, bypassing normal security controls that would typically validate and authenticate library sources. This issue falls under CWE-426, which describes the insecure loading of dynamic libraries, making it particularly dangerous as it allows attackers to inject malicious code into the target process. The vulnerability requires user interaction to exploit, meaning victims must visit a malicious webpage or open a crafted malicious file, but once triggered, it provides attackers with execution privileges within the context of the current process. The attack vector aligns with ATT&CK technique T1193, which involves exploiting malicious content delivered through web-based attacks, and T1059, covering the execution of malicious code through various system interfaces. The impact of this vulnerability extends beyond simple code execution as it can potentially allow attackers to gain persistent access to affected systems, escalate privileges, and establish backdoors. The fact that the vulnerability exists within APP file processing indicates that the application's trust model is flawed, as it does not properly validate the integrity of loaded libraries. This creates a significant risk for industrial environments where AVEVA Edge is deployed, as these systems often handle critical infrastructure data and operations. The vulnerability's classification as a remote code execution issue means that attackers can exploit it from outside the network perimeter, potentially leading to full system compromise without requiring physical access. Organizations using AVEVA Edge should prioritize patching this vulnerability as it represents a serious threat to operational technology environments. The vulnerability's exploitation requires user interaction, which suggests that security awareness training and email filtering solutions may help reduce the risk of successful exploitation. However, the underlying issue of insecure library loading remains a fundamental flaw that must be addressed through proper patching and code review processes. The vulnerability demonstrates the importance of implementing secure coding practices, particularly in industrial control systems where the consequences of exploitation can be severe and far-reaching.