CVE-2017-7968

An Incorrect Default Permissions issue was discovered in Schneider Electric Wonderware InduSoft Web Studio v8.0 Patch 3 and prior versions. Upon installation, Wonderware InduSoft Web Studio creates a new directory and two files, which are placed in the system's path and can be manipulated by non-administrators. This could allow an authenticated user to escalate his or her privileges.

• CWE-276
• CWE-276

• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-090-02Vendor Advisory
• http://www.securityfocus.com/bid/98544Third Party Advisory, VDB Entry
• https://ics-cert.us-cert.gov/advisories/ICSA-17-138-02Third Party Advisory, US Government Resource
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-090-02Vendor Advisory
• http://www.securityfocus.com/bid/98544Third Party Advisory, VDB Entry
• https://ics-cert.us-cert.gov/advisories/ICSA-17-138-02Third Party Advisory, US Government Resource

Published

May 19, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7962The iwgif_read_image function in imagew-gif.c in libimagewor…
• CVE-2017-7963The GNU Multiple Precision Arithmetic Library (GMP) interfac…
• CVE-2017-7964Zyxel WRE6505 devices have a default TELNET password of 1234…
• CVE-2017-7965A buffer overflow vulnerability exists in Programming Softwa…7.3
• CVE-2017-7966A DLL Hijacking vulnerability in the programming software in…
• CVE-2017-7967All versions of VAMPSET software produced by Schneider Elect…
• CVE-2017-7969A cross-site request forgery vulnerability exists on the Sec…
• CVE-2017-7970A vulnerability exists in Schneider Electric's PowerSCADA An…
• CVE-2017-7971A vulnerability exists in Schneider Electric's PowerSCADA An…
• CVE-2017-7972A vulnerability exists in Schneider Electric's PowerSCADA An…
• CVE-2017-7973A SQL injection vulnerability exists in Schneider Electric's…
• CVE-2017-7974A path traversal information disclosure vulnerability exists…