Actively exploited · Published Apr 25, 2014 · Assigned by icscert

CVE-2014-0780InduSoft Web Studio Path Traversal

Critical 9.8 Exploited

In plain English

A critical-severity path traversal in Web Studio from InduSoft. Attackers are actively exploiting it in the wild (listed by CISA on April 15, 2022). The chance it is exploited in the next 30 days is estimated at 74.7% (higher than 99.5% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)74.7%top 0.5% of all CVEs

Exploited in the wildYesCISA KEV since Apr 15, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 6, 2022.

Official description

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

Affected products (as reported)

Vendor	Product	Versions
InduSoft	Web Studio	7.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

42699 exploit, x_refsource_EXPLOIT-DB
https://www.cisa.gov/news-events/ics-advisories/icsa-14-107-02
67056 vdb-entry, x_refsource_BID
http://download.indusoft.com/71.2.4/IWS71.2.4.zip
http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02 x_refsource_MISC, x_transferred
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0780 government-resource