critical10.0Public exploit code
CVE-2011-4051
CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attac…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- InduSoft Web Studio - Arbitrary File Upload / Remote Code Execution (Metasploit)2012-10-10 · remote · windows · Verified
Impact
CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attackers to execute arbitrary code via vectors related to creation of a file, loading a DLL, and process control.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Indusoft | Web Studio | Versions 6.1, 7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.indusoft.com/hotfixes/hotfixes.php
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-319-01.pdf
- http://www.zerodayinitiative.com/advisories/ZDI-11-330/
- http://www.indusoft.com/hotfixes/hotfixes.php
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-319-01.pdf
- http://www.zerodayinitiative.com/advisories/ZDI-11-330/