Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-17914

InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as that of the InduSoft Web Studio or InTouch Edge HMI (formerly InTouch Machine Edition) runtime.

Published

2018-11-02T13:29:00.230

Last Modified

2024-11-21T03:55:11.897

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Secondary
    CWE-258
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application aveva indusoft_web_studio 6.1 Yes
Application aveva indusoft_web_studio 6.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 7.1 Yes
Application aveva indusoft_web_studio 8.0 Yes
Application aveva indusoft_web_studio 8.0 Yes
Application aveva indusoft_web_studio 8.0 Yes
Application aveva indusoft_web_studio 8.0 Yes
Application aveva indusoft_web_studio 8.0 Yes
Application aveva indusoft_web_studio 8.0 Yes
Application aveva indusoft_web_studio 8.0 Yes
Application aveva indusoft_web_studio 8.0 Yes
Application aveva indusoft_web_studio 8.1 Yes
Application aveva indusoft_web_studio 8.1 Yes
Application aveva indusoft_web_studio 8.1 Yes
Application aveva indusoft_web_studio 8.1 Yes
Application aveva edge 8.1 Yes
Application aveva edge 8.1 Yes
Application aveva intouch_machine_edition_2014 r2 Yes
References