CVE-2011-4051
CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attackers to execute arbitrary code via vectors related to creation of a file, loading a DLL, and…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 69.1%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attackers to execute arbitrary code via vectors related to creation of a file, loading a DLL, and process control.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 69.09% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- indusoft/web studio
- Source
- cret@cert.org
References
- http://www.indusoft.com/hotfixes/hotfixes.phpPatch
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-319-01.pdfUS Government Resource
- http://www.zerodayinitiative.com/advisories/ZDI-11-330/Patch
- http://www.indusoft.com/hotfixes/hotfixes.phpPatch
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-319-01.pdfUS Government Resource
- http://www.zerodayinitiative.com/advisories/ZDI-11-330/Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.