PT-2011-4830 · Indusoft · Indusoft Web Studio

Luigi Auriemma · Published 2011-11-16 · Updated 2011-12-08 · CVE-2011-4051

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions InduSoft Web Studio versions 6.1 through 7.0

Description The issue allows remote attackers to execute arbitrary code without requiring authentication. This is related to vectors involving the creation of a file, loading a DLL, and process control in the CEServer component of the Remote Agent module.

Recommendations For InduSoft Web Studio versions 6.1 through 7.0, consider restricting access to the CEServer.exe component until a patch is available. As a temporary workaround, avoid using the Remote Agent module in InduSoft Web Studio versions 6.1 through 7.0 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-4051

ZDI-11-330

Affected Products

Indusoft Web Studio

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/scada/indusoft_webstudio_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/21837 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-11-330 · Security Note
• http://indusoft.com/hotfixes/hotfixes.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-4051 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-11-330 · Patch
• http://us-cert.gov/control_systems/pdf/ICSA-11-319-01.pdf · Note