CVE-2014-0780

CRITICAL KEV

InduSoft Web Studio 7.1 - Path Traversal and Arbitrary Code Execution via NTWebServer

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2014-0780 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 15, 2022. EIP tracks 1 public exploit from researchers including James Fitts.

AI-analyzed exploit summary This Metasploit auxiliary module exploits a directory traversal vulnerability in Indusoft Web Studio <= 7.1 before SP2 Patch 4, allowing unauthorized file downloads from the underlying system. It sends a crafted HTTP GET request with traversal sequences to retrieve files like 'boot.ini'.

Description

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.

Exploits (1)

exploitdb WORKING POC
by James Fitts · rubywebappswindows
https://www.exploit-db.com/exploits/42699

This Metasploit auxiliary module exploits a directory traversal vulnerability in Indusoft Web Studio <= 7.1 before SP2 Patch 4, allowing unauthorized file downloads from the underlying system. It sends a crafted HTTP GET request with traversal sequences to retrieve files like 'boot.ini'.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Indusoft Web Studio <= 7.1 before SP2 Patch 4
No auth needed
Prerequisites: Network access to the target system · Indusoft Web Studio running on port 80
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Patch, Third Party Advisory, US Government Resource
http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/42699/
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/67056
Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-14-107-02

Scores

CVSS v3 9.8
EPSS 0.8925
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact total

Details

CISA KEV 2022-04-15
VulnCheck KEV 2022-01-12
InTheWild.io 2022-04-15
ENISA EUVD EUVD-2014-0811
CWE
CWE-22
Status published
Products (2)
InduSoft/Web Studio 7.1
indusoft/web_studio 7.1 (3 CPE variants)
Published Apr 25, 2014
KEV Added Apr 15, 2022
Tracked Since Feb 18, 2026