CVE-2017-13997
A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouc…
Published 9 y ago · modified 4 mo ago · JSON
Summary
A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes of performing customized calculations or actions. A remote malicious entity could bypass the server authentication and trigger the execution of an arbitrary command. The command is executed under high privileges and could lead to a complete compromise of the server.
Exploit prediction (EPSS)
5.05% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- n/a Schneider Electric InduSoft Web Studio, InTouch Machine Edition
Classification
- Weakness
- CWE-306 Missing Authentication for Critical Functionality
References
- ics-cert.us-cert.gov /advisories/ICSA-17-264-01 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/100952 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-13997
- NVD: CVE-2017-13997
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.