CVE-2014-0780

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
InduSoft	Web Studio	7.1

References

http://download.indusoft.com/71.2.4/IWS71.2.4.zipBroken Link
http://www.securityfocus.com/bid/67056Broken Link, Third Party Advisory, VDB Entry
https://www.cisa.gov/news-events/ics-advisories/icsa-14-107-02US Government Resource
https://www.exploit-db.com/exploits/42699/Exploit, Third Party Advisory, VDB Entry
http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02Patch, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/67056Broken Link, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/42699/Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0780US Government Resource

Timeline

Published: Apr 25, 2014
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 15, 2022
NVD status: Analyzed

Related CVEs from 2014

CVE-2014-07819.3Heap-based buffer overflow in BKCLogSvr.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary cod CVE-2014-07828.3Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R CVE-2014-07839.0Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code CVE-2014-07848.3Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary cod CVE-2014-07865.0Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements tha CVE-2014-078710.0Stack-based buffer overflow in WellinTech KingSCADA before 3.1.2.13 allows remote attackers to execute arbitrary code via a crafted packet.CVE-2014-07897.8Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS3 CVE-2014-07916.8Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to CVE-2014-07927.5Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vecto CVE-2014-07934.3Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote CVE-2014-07944.3SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authenticated users to execut CVE-2014-08025.8Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and e