critical9.8Known exploitedPublic exploit code
CVE-2014-0780
InduSoft Web Studio NTWebServer Directory Traversal Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-04-15. Federal due date: 2022-05-06.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Indusoft Web Studio - Directory Traversal Information Disclosure (Metasploit)2017-09-13 · webapps · windows
Impact
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Indusoft | Web Studio | Version 7.1 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://download.indusoft.com/71.2.4/IWS71.2.4.zip
- http://www.securityfocus.com/bid/67056
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-107-02
- https://www.exploit-db.com/exploits/42699/
- http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02
- http://www.securityfocus.com/bid/67056
- https://www.exploit-db.com/exploits/42699/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0780