InduSoft Web Studio NTWebServer Directory Traversal Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 24, 2014 · Catalog

   Detected

   Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

2. Apr 15, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 6, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

Affected

• cpe indusoft/web studio7.1
• vendor InduSoft Web Studioversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2014-0780

  InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.

  cisa.gov
• CVE.orgVulnerability recordCVE-2014-0780

  Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

  cve.org
• FIRST EPSSExploitation probabilityCVE-2014-0780

  30-day exploitation probability 74.7%

  first.org
• Exploit DatabasePublic exploit reference42699

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• NIST NVDVulnerability recordCVE-2014-0780

  Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

  nvd.nist.gov

References

• Broken Link · download.indusoft.com
• Patch · ics-cert.us-cert.gov
• Broken Link · securityfocus.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• US Government Resource · cisa.gov
• Exploit · exploit-db.com