PT-2014-3840 · Indusoft · Indusoft Web Studio

James Fitts · Published 2014-04-25 · Updated 2025-09-25 · CVE-2014-0780

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions InduSoft Web Studio version 7.1 before SP2 Patch 4

Description The issue allows remote attackers to read administrative passwords in APP files and execute arbitrary code via unspecified web requests. This is due to a directory traversal vulnerability in NTWebServer.

Recommendations For InduSoft Web Studio version 7.1 before SP2 Patch 4, apply SP2 Patch 4 to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-0780

ZDI-14-118

Affected Products

Indusoft Web Studio

References · 9

• 🔥 https://exploit-db.com/exploits/42699 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-0780 · Security Note
• http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02 · Patch
• https://zerodayinitiative.com/advisories/ZDI-14-118 · Security Note
• https://t.me/cveNotify/136439 · Telegram Post
• http://securityfocus.com/bid/67056 · Note
• http://download.indusoft.com/71.2.4/IWS71.2.4.zip · Note
• https://cisa.gov/news-events/ics-advisories/icsa-14-107-02 · Note
• https://t.me/cvenotify/111122 · Telegram Post