CVE-2018-17916

InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. A remote attacker could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed. If InduSoft Web Studio remote communication security was not enabled, or a password was left blank, a remote user could send a carefully crafted packet to invoke an arbitrary process, with potential for code to be executed. The code would be executed under the privileges of the InduSoft Web Studio or InTouch Edge HMI runtime and could lead to a compromise of the InduSoft Web Studio or InTouch Edge HMI server machine.

• CWE-121
• CWE-787

• https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01Mitigation, Third Party Advisory, US Government Resource
• https://www.tenable.com/security/research/tra-2018-34Exploit, Third Party Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01Mitigation, Third Party Advisory, US Government Resource
• https://www.tenable.com/security/research/tra-2018-34Exploit, Third Party Advisory

Published

Nov 2, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17910WebAccess Versions 8.3.2 and prior. The application fails to…
• CVE-2018-17911LAquis SCADA Versions 4.1.0.3870 and prior has several stack…7.8
• CVE-2018-17912An XXE vulnerability exists in CASE Suite Versions 3.10 and …
• CVE-2018-17913A type confusion vulnerability exists when processing projec…
• CVE-2018-17914InduSoft Web Studio versions prior to 8.1 SP2, and InTouch E…9.8
• CVE-2018-17915All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye …
• CVE-2018-17917All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye …
• CVE-2018-17918Circontrol CirCarLife all versions prior to 4.3.1, authentic…
• CVE-2018-17919All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye …
• CVE-2018-1792IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9…8.8
• CVE-2018-17921SAGA1-L8B with any firmware versions prior to A0.10 are vuln…8.8
• CVE-2018-17922Circontrol CirCarLife all versions prior to 4.3.1, the PAP c…