CVE-2018-17914

highPriorität · verfolgen · 41EPSS 0.046 · 92. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

4.57% (92nd) EPSS

CVSS 10 · high

Is it mine?

11 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-26

InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as that of the InduSoft Web Studio or InTouch Edge HMI (formerly InTouch Machine Edition) runtime.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenInTouch Edge HMI (formerly InTouch Machine Edition)cisa_csaf_ot
AVEVA recommends that users upgrade to InduSoft Web Studio v8.1 SP2 and InTouch Edge HMI (formerly InTouch Machine Edition) 2017 SP2 as soon as possible. Software updates can be downloaded from the Global Customer Support “Software Download” area
BehobenInduSoft Web Studiocisa_csaf_ot
AVEVA recommends that users upgrade to InduSoft Web Studio v8.1 SP2 and InTouch Edge HMI (formerly InTouch Machine Edition) 2017 SP2 as soon as possible. Software updates can be downloaded from the Global Customer Support “Software Download” area
MitigationInTouch Edge HMI (formerly InTouch Machine Edition)cisa_csaf_ot
AVEVA recommends that users update existing projects to enable the security features of InduSoft Web Studio and InTouch Edge HMI
MitigationInduSoft Web Studiocisa_csaf_ot
AVEVA recommends that users update existing projects to enable the security features of InduSoft Web Studio and InTouch Edge HMI

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

10.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 9–10

v2.010highAV:N/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 10

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-258USCWE-258US

betroffene Produkte (11)

Betroffene Produkte und Versionsbereiche.

InTouch Edge HMI (formerly InTouch Machine Edition): versions prior to 2017 SP2alle Versionencisa_csaf_otUS
InduSoft Web Studio: versions prior to 8.1 SP2alle Versionencisa_csaf_otUS
AVEVA Software, LLC InTouch Edge HMI (formerly InTouch Machine Edition)< 2017 SP2cisa_csaf_otUS
AVEVA Software, LLC InduSoft Web Studio< 8.1 SP2cisa_csaf_otUS
Unknown InduSoft Web Studio, and InTouch Edge HMI (formerly InTouch Machine Edition)≤ InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2enisa_euvdEU
aveva edge= 8.1nvdUScpe:2.3:a:aveva:edge:*:*:*:*:*:*:*:*
aveva indusoft web studio= 6.1nvdUScpe:2.3:a:aveva:indusoft_web_studio:*:*:*:*:*:*:*:*
aveva indusoft web studio= 7.1nvdUScpe:2.3:a:aveva:indusoft_web_studio:*:*:*:*:*:*:*:*
aveva indusoft web studio= 8.0nvdUScpe:2.3:a:aveva:indusoft_web_studio:*:*:*:*:*:*:*:*
aveva indusoft web studio= 8.1nvdUScpe:2.3:a:aveva:indusoft_web_studio:*:*:*:*:*:*:*:*
aveva intouch machine edition 2014= r2nvdUScpe:2.3:a:aveva:intouch_machine_edition_2014:*:*:*:*:*:*:*:*

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-18-305-01AVEVA InduSoft Web Studio and InTouch Edge HMI (formerly InTouch Machine Edition)2018-11-01icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an unauthenticated user to remotely execute code.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot nvd NVD CVE.org MITRE

veröffentlicht 2018-11-02geändert 2026-06-17

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01 cnnvd
https://www.schneider-electric.com/Patchcnnvd
https://www.tenable.com/security/research/tra-2018-34 cnnvd
https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01 enisa_euvd
https://www.tenable.com/security/research/tra-2018-34 enisa_euvd
https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01MitigationThird Party AdvisoryUS Government Resourcenvd
https://www.tenable.com/security/research/tra-2018-34ExploitThird Party Advisorynvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan