CVE-2014-0780

Description

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 7.5CVSS 2.0, Highfrom the CNA (icscert)AV:N/AC:L/Au:N/C:P/I:P/A:P
• 9.8CVSS 3.1, Criticalfrom CISA (ADP container)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What to do

• InduSoft did not intend for this web server to be used in real applications. It was provided as demonstration/training software (as stated in user manuals). They have created a mitigation for this vulnerability in InduSoft Web Studio v7.1+Service Pack 2+ Patch 4. Users may obtain this patch at the following location (you must be logged into your InduSoft account):  http://download.indusoft.com/71.2.4/IWS71.2.4.zip InduSoft technical support can be contacted at: support@indusoft.com .CNA solution statement
• Apply updates per vendor instructions.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 25 Apr 2014 Published
2. 15 Apr 2022 CVE-2014-0780 added to CISA KEV
3. 15 Apr 2022 Added to the CISA KEV catalogue

Weakness

• CWE-22

References

• 42699exploitx_refsource_EXPLOIT-DB
• www.cisa.gov
• 67056vdb-entryx_refsource_BID
• download.indusoft.com