CVE-2018-17914
Last modified
CVE-2018-17914 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as that of the InduSoft Web Studio or InTouch Edge HMI (formerly InTouch Machine Edition) runtime.. EPSS estimates a 4.57% chance of exploitation in the next 30 days.
Description
InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as that of the InduSoft Web Studio or InTouch Edge HMI (formerly InTouch Machine Edition) runtime.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Aveva | Indusoft Web Studio | 6.1 | Sp5 |
| Aveva | Indusoft Web Studio | 7.1 | — |
| Aveva | Indusoft Web Studio | 8.0 | — |
| Aveva | Indusoft Web Studio | 8.1 | — |
| Aveva | Edge | 8.1 | — |
| Aveva | Intouch Machine Edition 2014 | r2 | — |
References
- https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01Mitigation, Third Party Advisory, US Government Resource
- https://www.tenable.com/security/research/tra-2018-34Exploit, Third Party Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01Mitigation, Third Party Advisory, US Government Resource
- https://www.tenable.com/security/research/tra-2018-34Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-17914?
How severe is CVE-2018-17914?
How do I fix CVE-2018-17914?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-17909When processing project files in Omron CX-Supervisor Version…
- CVE-2018-1791IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an Extern…4.9
- CVE-2018-17910WebAccess Versions 8.3.2 and prior. The application fails to…
- CVE-2018-17911LAquis SCADA Versions 4.1.0.3870 and prior has several stack…7.8
- CVE-2018-17912An XXE vulnerability exists in CASE Suite Versions 3.10 and …
- CVE-2018-17913A type confusion vulnerability exists when processing projec…
- CVE-2018-17915All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye …
- CVE-2018-17916InduSoft Web Studio versions prior to 8.1 SP2, and InTouch E…9.8
- CVE-2018-17917All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye …
- CVE-2018-17918Circontrol CirCarLife all versions prior to 4.3.1, authentic…
- CVE-2018-17919All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye …
- CVE-2018-1792IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9…8.8
Are you affected by CVE-2018-17914?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST