CVE-2017-13997: Critical severity aveva indusoft web studio vulnerability
A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes of performing customized calculations or actions. A remote malicious entity could bypass the server authentication and trigger the execution of an arbitrary command. The command is executed under high privileges and could lead to a complete compromise of the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-13997?
CVE-2017-13997 has a critical severity rating due to missing authentication for critical functions in affected software.
How do I fix CVE-2017-13997?
To fix CVE-2017-13997, upgrade to InduSoft Web Studio version 8.0 SP3 or later and InTouch Machine Edition version 8.0 SP3 or later.
What software is affected by CVE-2017-13997?
CVE-2017-13997 affects Schneider Electric InduSoft Web Studio v8.0 SP2 and prior, and InTouch Machine Edition v8.0 SP2 and prior.
What is the nature of the vulnerability in CVE-2017-13997?
CVE-2017-13997 is a Missing Authentication for Critical Function vulnerability, allowing unauthorized script execution on the server.
When was CVE-2017-13997 reported?
CVE-2017-13997 was reported in 2017, highlighting a critical security issue in industrial control systems.