InduSoft · Web Studio

CVE-2014-0780

InduSoft Web Studio Path Traversal

Exploited in attacks High 7.5 Attack chance: 75%

What it is

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

CISA: InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 6, 2022

Added to the CISA list: April 15, 2022
Published: April 25, 2014
Severity: High 7.5 CVSS 2.0
Chance of attacks in the next 30 days (EPSS): 75% in the top 0.5% of all known vulnerabilities
Weakness: CWE-22
More details: NVD · CVE.org · CISA

All references (4)

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.