CVE-2019-6543
highpriority · attend · 55OT risk · highEPSS 0.173 · 97 %ileexploit · PoCEUUSEPSS · scored 2026-10-27
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedInTouch Edge HMI (formerly InTouch Machine Edition)cisa_csaf_ot
AVEVA recommends affected users upgrade to the latest version of affected products. The following security updates address the vulnerabilities outlined in this advisory. Software updates can be downloaded from the Global Customer Support “Software Download” area or from the links below: The latest version of InduSoft Web Studio can be found at: http://download.indusoft.com/81.3.0/IWS81.3.0.zipThe latest version of InTouch Edge HMI can be found at (login required): https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=52354For information on how to reach AVEVA support for a specific product, please refer to these links: AVEVA Software Global Customer Support and InduSoft Support.For the latest security information and security updates, please visit AVEVA's Security Central (login required) and InduSoft Security Updates.AVEVA has published Security Bulletin LFSEC00000133 on their website at the following location: https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec133.pdf
http://download.indusoft.com/81.3.0/IWS81.3.0.zip - FixedInduSoft Web Studiocisa_csaf_ot
AVEVA recommends affected users upgrade to the latest version of affected products. The following security updates address the vulnerabilities outlined in this advisory. Software updates can be downloaded from the Global Customer Support “Software Download” area or from the links below: The latest version of InduSoft Web Studio can be found at: http://download.indusoft.com/81.3.0/IWS81.3.0.zipThe latest version of InTouch Edge HMI can be found at (login required): https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=52354For information on how to reach AVEVA support for a specific product, please refer to these links: AVEVA Software Global Customer Support and InduSoft Support.For the latest security information and security updates, please visit AVEVA's Security Central (login required) and InduSoft Security Updates.AVEVA has published Security Bulletin LFSEC00000133 on their website at the following location: https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec133.pdf
http://download.indusoft.com/81.3.0/IWS81.3.0.zip
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9–10
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- EDB-46342Indusoft Web Studio 8.1 SP2 - Remote Code ExecutionPoC · exploit_db
affected products (10)
Products and version ranges known to be affected.
- ICS-CERT AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update≤ AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Updateenisa_euvdEU
- aveva intouch machine edition 2014= r2nvdUScpe:2.3:a:aveva:intouch_machine_edition_2014:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-19-036-01AVEVA InduSoft Web Studio and InTouch Edge HMI2019-02-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow a remote attacker to execute an arbitrary process using a specially crafted database connection configuration file.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://ics-cert.us-cert.gov/advisories/ICSA-19-036-01cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-6543cnnvd
- https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec133.pdf?hsLang=enPatchcnnvd
- https://www.auscert.org.au/bulletins/75070cnnvd
- https://www.exploit-db.com/exploits/46342/cnnvd
- https://www.tenable.com/security/research/tra-2019-04cnnvd
- https://ics-cert.us-cert.gov/advisories/ICSA-19-036-01enisa_euvd
- https://www.exploit-db.com/exploits/46342/enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan