CVEvulnerability

CVE-2018-17914

9.8 CRITICAL Published 2018-11-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-11-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-258

Description

InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as that of the InduSoft Web Studio or InTouch Edge HMI (formerly InTouch Machine Edition) runtime.

Affected configurations

• aveva indusoft web studio 6.1 • aveva indusoft web studio 7.1 • aveva indusoft web studio 8.0 • aveva indusoft web studio 8.1 • aveva edge 8.1 • aveva intouch machine edition 2014 r2

Related

Weakness · CWE (1)

  • CWE-258 Empty Password in Configuration File weakness

References