CVE-2022-28687 in Edge
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16257.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/20/2026
CVE-2022-28687 represents a critical code execution vulnerability affecting AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000) installations. This vulnerability falls under the CWE-426 Untrusted Search Path category, where the application fails to properly validate the source of dynamically loaded libraries. The flaw specifically manifests in the handling of APP files, which are commonly used within industrial automation environments for configuration and operational tasks. When a user interacts with a malicious APP file, the system's loading mechanism attempts to load a library from an unsecured location without proper validation of the library's authenticity or source. This insecure library loading behavior creates a pathway for attackers to inject malicious code that executes with the privileges of the currently running process. The vulnerability requires user interaction to exploit, meaning that a successful attack would typically involve social engineering tactics to convince a user to open a malicious file or visit a compromised webpage that triggers the vulnerable code path. The attack surface is particularly concerning in industrial control systems where AVEVA Edge is commonly deployed, as these environments often have limited security monitoring and may lack the sophisticated threat detection capabilities found in enterprise networks. From an operational perspective, this vulnerability could lead to complete system compromise, allowing attackers to execute arbitrary commands, install backdoors, or manipulate industrial processes. The ATT&CK framework categorizes this vulnerability under T1059 Command and Scripting Interpreter and T1068 Exploitation for Privilege Escalation, as the successful exploitation would enable attackers to execute code in the context of the current process and potentially escalate privileges. The impact extends beyond simple code execution, as industrial control systems may be connected to critical infrastructure where unauthorized access could result in operational disruptions, safety hazards, or data breaches. Organizations using AVEVA Edge in production environments should prioritize immediate remediation through vendor-provided patches, while implementing network segmentation to limit the potential lateral movement of attackers who might gain initial access through this vulnerability. The vulnerability highlights the importance of secure coding practices, particularly in industrial software where the attack surface often includes user-facing file handling mechanisms that must be rigorously validated to prevent unauthorized code execution. Additionally, this vulnerability demonstrates the need for comprehensive security assessments of industrial control systems, as traditional enterprise security measures may not adequately protect these specialized environments from attacks targeting specific application flaws.