CVE-2014-0780
InduSoft Web Studio Path Traversal
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
Exploit likelihood
What each source reports
CVE List
InduSoft Web Studio Path Traversal
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
- Record
CVE-2014-0780- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22, CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2014-0811
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
- Record
EUVD-2014-0811- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8mf8-x5px-f6px
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4...
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
- Record
GHSA-8mf8-x5px-f6px- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
CISA KEV No score
InduSoft Web Studio NTWebServer Directory Traversal Vulnerability
InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.
- Record
CVE-2014-0780- Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
- Record
CVE-2014-0780- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Indusoft Web Studio - Directory Traversal Information Disclosure (Metasploit) | 2017-09-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0780 is a vulnerability (CVSS 7.5) in Indusoft Web Studio, published April 25, 2014. CISA lists it as known to be exploited, since April 15, 2022. EUVD reports exploitation since April 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.7%, the 99th percentile. No source names a fixed version.
References
exploit-db.com/exploits/42699
cisa.gov/news-events/ics-advisories/icsa-14-107-02
securityfocus.com/bid/67056
download.indusoft.com/71.2.4/IWS71.2.4.zip
ics-cert.us-cert.gov/advisories/ICSA-14-107-02
nvd.nist.gov/vuln/detail/CVE-2014-0780
github.com/advisories/GHSA-8mf8-x5px-f6px