CVE-2017-13997
CriticalSummary
A Missing Authentication for Critical Function issue was discovered in InduSoft Web Studio v8.0 SP2 and prior, and InTouch Machine Edition v8.0 SP2 and prior. A remote malicious entity could bypass server authentication and trigger the execution of an arbitrary command.
Risk Assessment
An attacker could gain access to the server with high privileges, potentially leading to a complete compromise of the system. This poses a serious security threat to the organization.
Recommendation
It is recommended to update InduSoft Web Studio and InTouch Machine Edition to the latest version to mitigate this vulnerability. Additionally, appropriate authentication mechanisms for critical functions should be implemented.
Original NVD description (English source)
A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes of performing customized calculations or actions. A remote malicious entity could bypass the server authentication and trigger the execution of an arbitrary command. The command is executed under high privileges and could lead to a complete compromise of the server.