InduSoft Web Studio Directory Traversal Vulnerability

Vulnerabilities 1

• Critical 9.8
  CVE-2014-0780 Exploited Public exploit EPSS 75%

  InduSoft Web Studio Path Traversal

  Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

  InduSoft Web Studio
  Apr 25, 2014

  KEV Apr 15, 2022

Revision history

1. 2025-06-06 #2

   Advisory converted into a CSAF

2. 2014-01-18 #1

   Initial Publication

References

• ICS Advisory ICSA-14-107-02 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-14-107-02
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014