What is the severity of CVE-2017-13997?

CVE-2017-13997 has a critical severity rating due to missing authentication for critical functions in affected software.

How do I fix CVE-2017-13997?

To fix CVE-2017-13997, upgrade to InduSoft Web Studio version 8.0 SP3 or later and InTouch Machine Edition version 8.0 SP3 or later.

What software is affected by CVE-2017-13997?

CVE-2017-13997 affects Schneider Electric InduSoft Web Studio v8.0 SP2 and prior, and InTouch Machine Edition v8.0 SP2 and prior.

What is the nature of the vulnerability in CVE-2017-13997?

CVE-2017-13997 is a Missing Authentication for Critical Function vulnerability, allowing unauthorized script execution on the server.

When was CVE-2017-13997 reported?

CVE-2017-13997 was reported in 2017, highlighting a critical security issue in industrial control systems.

Vulnerability/
CVE-2017-13997

critical

CWE

306

2/10/2017

5/8/2024

CVE-2017-13997

First published: Mon Oct 02 2017(Updated: )

A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes of performing customized calculations or actions. A remote malicious entity could bypass the server authentication and trigger the execution of an arbitrary command. The command is executed under high privileges and could lead to a complete compromise of the server.

Credit: ics-cert@hq.dhs.gov

Affected Software	Affected Version	How to fix
AVEVA InduSoft Web Studio	<=8.0
Wonderware InTouch	<=8.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2017-13997?
CVE-2017-13997 has a critical severity rating due to missing authentication for critical functions in affected software.
How do I fix CVE-2017-13997?
To fix CVE-2017-13997, upgrade to InduSoft Web Studio version 8.0 SP3 or later and InTouch Machine Edition version 8.0 SP3 or later.
What software is affected by CVE-2017-13997?
CVE-2017-13997 affects Schneider Electric InduSoft Web Studio v8.0 SP2 and prior, and InTouch Machine Edition v8.0 SP2 and prior.
What is the nature of the vulnerability in CVE-2017-13997?
CVE-2017-13997 is a Missing Authentication for Critical Function vulnerability, allowing unauthorized script execution on the server.
When was CVE-2017-13997 reported?
CVE-2017-13997 was reported in 2017, highlighting a critical security issue in industrial control systems.

agent/references
agent/type
collector/mitre-cve
source/MITRE
agent/weakness
agent/author
agent/severity
agent/last-modified-date
agent/first-publish-date
agent/event
agent/description
agent/source
collector/nvd-index
agent/software-canonical-lookup-request
agent/softwarecombine
agent/tags
vendor/schneider-electric
canonical/aveva indusoft web studio
version/aveva indusoft web studio/8.0
canonical/wonderware intouch
version/wonderware intouch/8.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.