title: AVEVA Edge products  Uncontrolled Search Path Element
description:
The vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege escalation by tricking AVEVA Edge to load an unsafe DLL.
problem types: CWE-427 Uncontrolled Search Path Element
affected:
{
defaultStatus: unaffected
product: AVEVA Edge
vendor: AVEVA
versions:
lessThanOrEqual: 2020 R2 SP2, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
AVEVA recommends users upgrade to AVEVA Edge 2023, or AVEVA Edge 2020 R2 SP2 P01 as soon as possible. Upgrades can be downloaded from the AVEVA official website:  AVEVA Edge 2023 https://softwaresupportsp.aveva.com/#/producthub/details ,  AVEVA Edge 2020 R2 SP2 P01 https://softwaresupportsp.aveva.com/#/producthub/details .
*  Note: Log-in is required.
For additional information, please refer to AVEVA's security advisory  AVEVA-2024-002. https://www.aveva.com/en/support-and-success/cyber-security-updates/