Unscored severity · published Dec 5, 2011
CVE-2011-4051
CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attackers to execute…
–
CVSS
67.8%
EPSS
No
On KEV
Description
CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attackers to execute arbitrary code via vectors related to creation of a file, loading a DLL, and process control.
Exploitation
Is it being used?
Exploit prediction (EPSS)67.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Web Studio · Indusoft
6.1; 7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4051
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4051
Patch
http://www.indusoft.com/hotfixes/hotfixes.php
US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-11-319-01.pdf
Patch
http://www.zerodayinitiative.com/advisories/ZDI-11-330/
More from Web Studio
9.8
CVE-2014-0780
InduSoft Web Studio Path Traversal
9.8
CVE-2018-8840
A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag,…
–
CVE-2015-7375
Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service (unhandled runtime exception and application…
–
CVE-2015-7374
The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649
–
CVE-2015-1009
Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage,…