PT-2018-14266 · Indusoft+1 · Indusoft Web Studio+1

Published 2018-11-02 · Updated 2021-04-08 · CVE-2018-17914

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InduSoft Web Studio versions prior to 8.1 SP2 InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2

Description This issue could allow an unauthenticated user to remotely execute code with the same privileges as that of the InduSoft Web Studio or InTouch Edge HMI runtime.

Recommendations For InduSoft Web Studio versions prior to 8.1 SP2, update to version 8.1 SP2 or later. For InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2, update to version 2017 SP2 or later.

Exploit

Fix

Weakness Enumeration

CWE-258

Related Identifiers

CVE-2018-17914

Affected Products

Intouch Edge Hmi

Indusoft Web Studio

References · 5

• 🔥 https://tenable.com/security/research/tra-2018-34 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17914 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17914 · Vendor Advisory
• https://t.me/cvenotify/12939 · Telegram Post
• https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01 · Note