CVE-2017-13997

🗓️ 02 Oct 2017 05:00:00Reported by icscertType

Schneider Electric InduSoft Web Studio & InTouch Machine Edition v8.0 SP2 or prior - Missing Authentication for Critical Function CVE-2017-13997

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of Schneider Electric InTouch Machine Edition and InduSoft Web Studio HMI/SCADA systems lies in their authentication procedures, which allow attackers to execute arbitrary commands and gain full control over the server.	4 Dec 201700:00	–	bdu_fstec
CNVD	Schneider Electric InduSoft Web Studio and InTouch Machine Edition Remote Code Execution Vulnerability	22 Sep 201700:00	–	cnvd
Cvelist	CVE-2017-13997	2 Oct 201705:00	–	cvelist
EUVD	EUVD-2017-5512	7 Oct 202500:30	–	euvd
ICS	Schneider Electric InduSoft Web Studio, InTouch Machine Edition	21 Sep 201700:00	–	ics
NVD	CVE-2017-13997	3 Oct 201701:29	–	nvd
OpenVAS	InduSoft Web Studio Authentication Bypass Vulnerability (Nov 2017) - Windows	3 Nov 201700:00	–	openvas
OpenVAS	InTouch Machine Edition Authentication Bypass Vulnerability (Nov 2017) - Windows	20 Nov 201700:00	–	openvas
Prion	Authentication flaw	3 Oct 201701:29	–	prion
Tenable Nessus	Schneider Electric InduSoft Web Studio < 8.0 SP2 Patch 1 Unspecified Remote Command Execution (LFSEC00000121)	23 Oct 201700:00	–	nessus

NVD

Vulners

Node

schneider-electric wonderware_indusoft_web_studioRange≤8.0sp2

schneider-electric wonderware_intouchRange≤8.0sp2machine

[
  {
    "product": "Schneider Electric InduSoft Web Studio, InTouch Machine Edition",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Schneider Electric InduSoft Web Studio, InTouch Machine Edition"
      }
    ]
  }
]

Source	Link
ics-cert	www.ics-cert.us-cert.gov/advisories/ICSA-17-264-01
securityfocus	www.securityfocus.com/bid/100952

13 May 2026 00:24Current

9.7High risk

Vulners AI Score9.7

CVSS 39.8

CVSS 210

EPSS0.01586

CWE-306