Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities

OVERVIEW Gleb Gritsai, Ilya Karpov, and Kirill Nesterov of Positive Technologies Security Lab and independent researcher Alisa Esage Shevchenko have identified vulnerabilities in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014. Schneider Electric has released new patch...

InduSoft Web Studio 'Remote Agent' Code Execution Vulnerability - Windows

InduSoft Web Studio is prone to a code execution vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

InduSoft Web Studio 'NTWebServer' Directory Traversal Vulnerability - Windows

InduSoft Web Studio is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Schneider Electric InduSoft Web Studio Remote Agent Remote Code Execution (CVE-2015-7374)

The vulnerability is due to lack of authentication to the Remote Agent Service which allows attackers to execute API calls on the service remotely. By sending crafted requests to the service, a remote unauthenticated attacker can exploit this vulnerability to execute code under the context of the...

Schneider Electric InduSoft Web Studio Arbitrary Code Execution Vulnerability

Schneider Electric InduSoft Web Studio is an embedded HMI software package.Remote Agent is one of the remote agent components. A security vulnerability in Schneider Electric InduSoft Web Studio's handling of Indusoft Project files allows an attacker to construct a malicious file and trick an...

Schneider Electric InduSoft Web Studio Remote Agent Component Code Execution Vulnerability

Schneider Electric InduSoft Web Studio is an embedded HMI software package.Remote Agent is one of the remote agent components. A security vulnerability exists in the Remote Agent component of Schneider Electric InduSoft Web Studio that could be exploited by a remote attacker to submit a special...

InduSoft Web Studio Remote Agent Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of InduSoft WebStudio. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Remote Agent service listening on TCP port 1234. The issue lies in the lack o...

CVE-2015-7375

Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service unhandled runtime exception and application crash via a crafted Indusoft Project file...

Design/Logic Flaw

The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649...

CVE-2015-7374

The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649...

Code injection

Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service unhandled runtime exception and application crash via a crafted Indusoft Project file...

CVE-2015-7374

CVE-2015-7374 affects Schneider Electric InduSoft Web Studio via the Remote Agent component (Windows). The vulnerability enables remote code execution due to lack of authentication on the Remote Agent service (TCP port 1234), allowing remote API calls to be executed with the process’s privileges....

CVE-2015-7375

Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service unhandled runtime exception and application crash via a crafted Indusoft Project file...

CVE-2015-7375

Schneider Electric InduSoft Web Studio is affected by CVE-2015-7375. The vulnerability arises in the handling/parsing of Indusoft Project files, allowing remote code execution or a denial of service (unhandled runtime exception and application crash) in InduSoft Web Studio before version 8.0. Pub...

CVE-2015-7374

The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649...

InduSoft Web Studio Detection (Windows SMB Login)

Detects the installed version of InduSoft Web Studio. The script logs in via smb, searches for InduSoft Web Studio in the registry and gets the version from SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Schneider Electric InduSoft Web Studio < 7.1.3.5 Local Plaintext Password Information Disclosure (SEVD-2015-100-01)

Binary data scadaindusoftwebstudioSEVD2015-100-01.nbin...

Schneider Electric InduSoft Password Storage Vulnerability

InduSoft Web Studio is a SCADA system and embedded instrumentation solution for developing HMIs, supervisory control and data acquisition. Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 stores the passwords for the...

Design/Logic Flaw

Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file...

CVE-2015-1009

Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file...