9.8Critical
KEV
CVE-2014-0780InduSoft Web Studio Path Traversal
Known exploited — InduSoft Web Studio NTWebServer Directory Traversal Vulnerability
CISA confirmed this vulnerability is used in real attacks on 15.04.2022. Remediation deadline for US federal agencies: 06.05.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2014-0780
Description
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
Weakness (CWE):
CWE-22
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| InduSoft | Web Studio | 7.1 |
References and patches
- 42699 exploitExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-107-02 US Government Resource
- 67056 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- http://download.indusoft.com/71.2.4/IWS71.2.4.zip Broken Link
- http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02 PatchThird Party AdvisoryUS Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0780 US Government Resource
CPE matches (NVD) (3)
cpe:2.3:a:indusoft:web_studio:7.1:-:*:*:*:*:*:*cpe:2.3:a:indusoft:web_studio:7.1:sp1:*:*:*:*:*:*cpe:2.3:a:indusoft:web_studio:7.1:sp2:*:*:*:*:*:*