10

CVE-2018-17914

Exploit
InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as that of the InduSoft Web Studio or InTouch Edge HMI (formerly InTouch Machine Edition) runtime.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Aveva ≫ Indusoft Web Studio Version 6.1 Update sp5
Aveva ≫ Indusoft Web Studio Version 6.1 Update sp6_p3
Aveva ≫ Indusoft Web Studio Version 7.1
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp1
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp2
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p1
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p2
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p3
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p4
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p5
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p6
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p7
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p8
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p9
Aveva ≫ Indusoft Web Studio Version 8.0
Aveva ≫ Indusoft Web Studio Version 8.0 Update p1
Aveva ≫ Indusoft Web Studio Version 8.0 Update p2
Aveva ≫ Indusoft Web Studio Version 8.0 Update p3
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp1
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp1_p1
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp2
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp2_p1
Aveva ≫ Indusoft Web Studio Version 8.1
Aveva ≫ Indusoft Web Studio Version 8.1 Update p1
Aveva ≫ Indusoft Web Studio Version 8.1 Update sp1
Aveva ≫ Indusoft Web Studio Version 8.1 Update sp1_p1
Aveva ≫ Edge Version 8.1 Update -
Aveva ≫ Edge Version 8.1 Update sp1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.57% 0.904
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-258 Empty Password in Configuration File

Using an empty string as a password is insecure.

https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01
Third Party Advisory
US Government Resource
Mitigation
https://www.tenable.com/security/research/tra-2018-34
Third Party Advisory
Exploit