CVE-2021-41278: Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in proces

Q: How do I fix CVE-2021-41278?

app service configurable: upgrade to 2.1.0; application functions software development kit: upgrade to 2.1.0; edgex foundry: upgrade to 2.1.0. Exact commands for each OS are on this page.

Q: Is CVE-2021-41278 being exploited?

CVE-2021-41278 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2021-41278 affect?

CVE-2021-41278 affects app service configurable, application functions software development kit, edgex foundry. Severity is medium (CVSS 5.7). Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX IoT platform. In affected versions broken encryption in app-functions-sdk “AES”

Q: How urgent is CVE-2021-41278?

Priority 27/100. No elevated risk signals yet.

Routine

MEDIUM 5.7UPGRADEUPGRADEUPGRADE

CVE-2021-41278 is a medium-severity flaw (CVSS 5.7) affecting app service configurable, application functions software development kit, edgex foundry. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX IoT platform. In affected versions broken encryption in app-functions-sdk “AES” transform in EdgeX Foundry releases prior to Jakarta allows attackers to decrypt messages via unspecified vectors. The app-functions-sdk exports an “aes” transform that user scripts can optionally call to encry

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	5.7 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	Required
EPSS exploit chance	0.4% (top 70%)
CISA exploited list	No
Weakness	CWE-327
Published	2021-11-19
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: edgexfoundry

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2021-11-19 00:15 UTCPublished CVE record published
2026-06-17 04:08 UTCUpdated Record last modified

edgexfoundry app service configurable UPGRADE

Affected: < 2.1.0

Fixed in: 2.1.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy app-service-configurable || rpm -q app-service-configurable || app-service-configurable --version

2. UPGRADE to 2.1.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade app-service-configurable

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade app-service-configurable

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

edgexfoundry application functions software development kit UPGRADE

Affected: < 2.1.0

Fixed in: 2.1.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy application-functions-software-development-kit || rpm -q application-functions-software-development-kit || application-functions-software-development-kit --version

2. UPGRADE to 2.1.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade application-functions-software-development-kit

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade application-functions-software-development-kit

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

edgexfoundry edgex foundry UPGRADE

Affected: < 2.1.0

Fixed in: 2.1.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy edgex-foundry || rpm -q edgex-foundry || edgex-foundry --version

2. UPGRADE to 2.1.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade edgex-foundry

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade edgex-foundry

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-41278?

app service configurable: upgrade to 2.1.0; application functions software development kit: upgrade to 2.1.0; edgex foundry: upgrade to 2.1.0. Exact commands for each OS are on this page.

Is CVE-2021-41278 being exploited?

CVE-2021-41278 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-41278 affect?

CVE-2021-41278 affects app service configurable, application functions software development kit, edgex foundry. Severity is medium (CVSS 5.7). Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX IoT platform. In affected versions broken encryption in app-functions-sdk “AES”

How urgent is CVE-2021-41278?

Priority 27/100. No elevated risk signals yet.

References

← Back to latest CVEs