CVE-2014-0780
InduSoft Web Studio NTWebServer Directory Traversal Vulnerability
Description
CVE-2014-0780 is a directory traversal vulnerability in InduSoft Web Studio's NTWebServer component that allows a remote, unauthenticated attacker to read arbitrary files from the system, including administrative credentials, and ultimately achieve remote code execution. The vulnerability is exploited by sending a specially crafted HTTP request containing path traversal sequences to the NTWebServer. CISA has added CVE-2014-0780 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 0.89% (99.5th percentile), this vulnerability ranks among the most likely to be exploited, making it a critical risk for organizations running unpatched InduSoft Web Studio installations in industrial automation environments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| indusoft | web studio | 7.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://download.indusoft.com/71.2.4/IWS71.2.4.zip(Broken Link)
- http://www.securityfocus.com/bid/67056(Broken Link, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-107-02(US Government Resource)
- https://www.exploit-db.com/exploits/42699/(Exploit, Third Party Advisory, VDB Entry)
- http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02(Patch, Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0780(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 describes a weakness where software uses external input to construct a pathname that should be restricted to a specific directory but fails to properly neutralize special path elements such as ".." sequences. In CVE-2014-0780, the NTWebServer component of InduSoft Web Studio does not properly validate HTTP request paths, allowing an attacker to traverse outside the intended web root and access arbitrary files on the system, including configuration files containing administrator passwords.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2014-0780 allows unauthenticated remote attackers to read any file accessible to the NTWebServer process, including configuration files that store administrative credentials in plaintext or reversible formats. The confidentiality impact is critical because stolen credentials enable full administrative access to the InduSoft Web Studio environment, which is used to design and operate HMI/SCADA systems controlling industrial processes. The integrity impact is equally severe — with administrative credentials, attackers can modify SCADA configurations, alter control logic, and deploy malicious projects to connected programmable logic controllers. The availability of industrial processes is directly threatened as attackers can disrupt operations, shut down monitored systems, or cause physical damage through manipulated control parameters. The EPSS score of 0.89% (99.5th percentile) and KEV listing confirm this is an actively weaponized vulnerability requiring immediate remediation.
Exploit Maturity
CVE-2014-0780 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming that this directory traversal vulnerability has been actively exploited in real-world attacks against InduSoft Web Studio deployments. The EPSS score of 0.89% (99.5th percentile) indicates an extremely high exploitation probability, reflecting the availability of public exploit code and the simplicity of the attack vector. Given that the vulnerability has been known since 2014 and exploitation is straightforward (a single crafted HTTP request), any unpatched NTWebServer instance exposed to the network should be considered compromised.
Remediation
- Apply vendor patches immediately as required by CISA KEV: update InduSoft Web Studio to a version that addresses the directory traversal vulnerability in NTWebServer.
- If patching is not immediately possible, restrict network access to the NTWebServer port using firewall rules, allowing connections only from trusted management workstations.
- Change all administrative credentials on InduSoft Web Studio installations, as they may have been compromised through file disclosure prior to patching.
- Audit system logs for suspicious HTTP requests containing path traversal sequences (e.g., "../" patterns) targeting the NTWebServer to identify potential past exploitation.
- Isolate InduSoft Web Studio servers in a dedicated OT network segment, separate from the corporate network and internet, following ICS security best practices.
Technical Details
CVE-2014-0780 exploits a directory traversal flaw in the NTWebServer component of InduSoft Web Studio, which serves as the embedded HTTP server for the HMI/SCADA platform. By sending an HTTP GET request with "../" path traversal sequences, an attacker can escape the web root directory and read arbitrary files from the underlying operating system. The most damaging exploitation path involves reading the InduSoft Web Studio configuration files that contain administrative usernames and passwords, which can then be used to authenticate to the system and execute arbitrary code through the platform's built-in scripting capabilities. The attack requires no authentication and is trivially exploitable from any network position with access to the NTWebServer port.
Frequently Asked Questions
Is CVE-2014-0780 being actively exploited?
Yes. CVE-2014-0780 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 0.89% (99.5th percentile) reflects extremely high exploitation probability, and public exploit code is available.
What products are affected by CVE-2014-0780?
CVE-2014-0780 affects InduSoft Web Studio, specifically the NTWebServer component that provides HTTP access to the HMI/SCADA platform. Organizations using InduSoft Web Studio in industrial automation environments should verify their version and patch status.
How do I fix CVE-2014-0780?
Update InduSoft Web Studio to the latest patched version. Immediately restrict network access to the NTWebServer port and change all administrative credentials, as they may have been exposed through the directory traversal vulnerability.
How severe is CVE-2014-0780?
CVE-2014-0780 is a critical vulnerability that chains directory traversal with credential theft to enable full remote code execution on InduSoft Web Studio servers. Its 99.5th percentile EPSS score and KEV listing confirm it as one of the most actively targeted vulnerabilities in the ICS/SCADA space.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.