CVE-2023-6132 is a high severity (CVSS 7.3) uncontrolled search path flaw in AVEVA Edge, formerly InduSoft Web Studio. Someone with file system access can trick it into loading an unsafe DLL, giving code execution and privilege escalation. CISA and AVEVA say to upgrade to AVEVA Edge 2023 or 2020 R2 SP2 P01.
What's affected
- Product: AVEVA Edge (formerly InduSoft Web Studio). CISA lists AVEVA Edge 2020 R2 SP2 and prior.
- Fixed: AVEVA Edge 2023, or AVEVA Edge 2020 R2 SP2 P01, per CISA advisory ICSA-24-032-03. The AVEVA download needs a login.
- Severity: 7.3 High in the NVD record and CISA (vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
- Source conflict: the NVD record lists AVEVA Platform Common Services 4.4.6, 4.5.0 and 4.5.1 and AVEVA Batch Management 2020 in its product data. CISA names AVEVA Edge. Check the AVEVA security bulletin AVEVA-2024-002 for the products that apply to you.
- Credit: CISA names Ting Chen of UESTC and ADLab of Venustech.
How to check if you're exposed
Open AVEVA Edge and check the version in the About dialog, or look at the installed programs list. AVEVA Edge 2020 R2 SP2 and anything older is affected unless the P01 patch is installed.
Because the NVD product list differs from CISA, also check whether AVEVA Platform Common Services or Batch Management is installed on the same machines, and read bulletin AVEVA-2024-002 for their status. The list of installed programs on each engineering station and HMI computer is the first thing to gather.
What to do now
- Upgrade to AVEVA Edge 2023, or install AVEVA Edge 2020 R2 SP2 P01, from the AVEVA download site (login required).
- Read AVEVA security bulletin AVEVA-2024-002 to confirm whether other AVEVA products on the same machines are affected.
- Restrict write access to the application folders, and to any folder the product searches for DLL files, to administrators.
- Follow CISA's industrial control system guidance: minimize network exposure, put control networks behind firewalls, and use secure remote access.
- Run an impact analysis before rolling out patches to production control systems, as CISA advises.
Why it matters
Windows programs look for DLL files in a set of folders, in order. If the program does not state exactly where its DLL must come from, a file placed in an earlier folder can be loaded in its place. The record lists CWE-427, uncontrolled search path element. CISA says an attacker needs file system access, and the vector shows local access with user interaction.
The point of the attack is escalation. Code in a DLL runs with the rights of the program that loads it, which may be higher than the attacker's own. In industrial settings, engineering stations often run with wide rights and have access to control systems. CISA does not list this issue as known exploited and the record agrees. The conflicting product lists in the sources are a reminder to read the vendor bulletin, not just the database entry.
Quick check
Why does the record list different products than CISA?
The sources do not say. The NVD product data names Platform Common Services and Batch Management, while CISA names AVEVA Edge. Use the AVEVA bulletin as the deciding source.
Sources
Last reviewed: 19 October 2026.
