Sign-up

ID

VAR-201303-0298


CVE

CVE-2013-1627


TITLE

Indusoft Studio and Advantech Studio Vulnerable to absolute path traversal

Trust: 0.8

sources: JVNDB: JVNDB-2013-001864

DESCRIPTION

Absolute path traversal vulnerability in NTWebServer.exe in Indusoft Studio 7.0 and earlier and Advantech Studio 7.0 and earlier allows remote attackers to read arbitrary files via a full pathname in an argument to the sub_401A90 CreateFileW function. Advantech Studio (AStudio) is an automated software tool that contains all the basic components for data acquisition and control. Advantech Studio has a directory traversal vulnerability. Advantech Studio and Indusoft Web Studio are prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Versions Advantech Studio/Indusoft Web Studio 7.0 and prior are vulnerable. The tool supports real-time dynamic graphic images, uses a browser to view trends, alarms, reports, imports or exports reports and real-time data in XML format, etc

Trust: 2.7

sources: NVD: CVE-2013-1627 // JVNDB: JVNDB-2013-001864 // CNVD: CNVD-2012-7470 // BID: 56871 // IVD: 0e010790-2353-11e6-abef-000c29c66e3d // VULHUB: VHN-61629

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 0e010790-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-7470

AFFECTED PRODUCTS

vendor:indusoftmodel:web studioscope:eqversion:7.0

Trust: 1.9

vendor:indusoftmodel:web studioscope:eqversion:7.0b2

Trust: 1.6

vendor:indusoftmodel:web studioscope:eqversion:6.1

Trust: 1.6

vendor:advantechmodel:studioscope:eqversion:6.1

Trust: 1.0

vendor:advantechmodel:studioscope:eqversion:7.0

Trust: 0.9

vendor:schneider electricmodel:indusoft web studioscope:lteversion:7.0

Trust: 0.8

vendor:advantechmodel:studioscope:lteversion:7.0

Trust: 0.8

vendor:advantech studiomodel: - scope:eqversion:6.1

Trust: 0.4

vendor:web studiomodel: - scope:eqversion:6.1

Trust: 0.4

vendor:web studiomodel: - scope:eqversion:7.0

Trust: 0.2

vendor:web studiomodel:7.0b2scope: - version: -

Trust: 0.2

sources: IVD: 0e010790-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-7470 // BID: 56871 // JVNDB: JVNDB-2013-001864 // CNNVD: CNNVD-201212-141 // NVD: CVE-2013-1627

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-1627
value: HIGH

Trust: 1.0

NVD: CVE-2013-1627
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201212-141
value: HIGH

Trust: 0.6

IVD: 0e010790-2353-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

VULHUB: VHN-61629
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2013-1627
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

IVD: 0e010790-2353-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-61629
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: 0e010790-2353-11e6-abef-000c29c66e3d // VULHUB: VHN-61629 // JVNDB: JVNDB-2013-001864 // CNNVD: CNNVD-201212-141 // NVD: CVE-2013-1627

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.9

sources: VULHUB: VHN-61629 // JVNDB: JVNDB-2013-001864 // NVD: CVE-2013-1627

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201212-141

TYPE

Path traversal

Trust: 0.8

sources: IVD: 0e010790-2353-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201212-141

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-001864

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-61629

PATCH
title:Top Pageurl:http://www.advantech.com/default.aspx
Trust: 0.8
title:InduSofturl:http://www.indusoft.com/
Trust: 0.8
title:パートナー情報url:http://www.advantech.co.jp/support-AJP/distributors.asp
Trust: 0.8
title:Advantechアドバンテック株式会社url:http://www.advantech.co.jp/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-001864

EXTERNAL IDS
db:NVDid:CVE-2013-1627
Trust: 3.0
db:ICS CERTid:ICSA-13-067-01
Trust: 2.8
db:BIDid:56871
Trust: 1.6
db:CNNVDid:CNNVD-201212-141
Trust: 0.9
db:JVNDBid:JVNDB-2013-001864
Trust: 0.8
db:CNVDid:CNVD-2012-7470
Trust: 0.6
db:ICS CERT ALERTid:ICS-ALERT-13-004-01
Trust: 0.3
db:IVDid:0E010790-2353-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:SEEBUGid:SSVID-76910
Trust: 0.1
db:EXPLOIT-DBid:23132
Trust: 0.1
db:VULHUBid:VHN-61629
Trust: 0.1
sources:
            
            
            IVD: 0e010790-2353-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2012-7470 // 
            
            
            
            VULHUB: VHN-61629 // 
            
            
            
            BID: 56871 // 
            
            
            
            JVNDB: JVNDB-2013-001864 // 
            
            
            
            CNNVD: CNNVD-201212-141 // 
            
            
            
            NVD: CVE-2013-1627

REFERENCES
url:http://ics-cert.us-cert.gov/pdf/icsa-13-067-01.pdf
Trust: 2.8
url:http://www.securityfocus.com/bid/56871
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-1627
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-1627
Trust: 0.8
url:http://www.advantech.com/products/advantech-studio/mod_3d1b45b0-b0af-405c-a9cc-a27b35774634.aspx
Trust: 0.3
url:http://www.indusoft.com/indusoftart.php?catid=1&name=iws/webstudio
Trust: 0.3
url:http://www.us-cert.gov/control_systems/pdf/ics-alert-13-004-01.pdf
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2012-7470 // 
            
            
            
            VULHUB: VHN-61629 // 
            
            
            
            BID: 56871 // 
            
            
            
            JVNDB: JVNDB-2013-001864 // 
            
            
            
            CNNVD: CNNVD-201212-141 // 
            
            
            
            NVD: CVE-2013-1627

CREDITS
Nin3
Trust: 0.9
sources:
            
            
            BID: 56871 // 
            
            
            
            CNNVD: CNNVD-201212-141

SOURCES
db:IVDid:0e010790-2353-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2012-7470
db:VULHUBid:VHN-61629
db:BIDid:56871
db:JVNDBid:JVNDB-2013-001864
db:CNNVDid:CNNVD-201212-141
db:NVDid:CVE-2013-1627

LAST UPDATE DATE
2025-04-11T23:05:37.814000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2012-7470date:2012-12-17T00:00:00
db:VULHUBid:VHN-61629date:2013-03-18T00:00:00
db:BIDid:56871date:2013-03-08T18:24:00
db:JVNDBid:JVNDB-2013-001864date:2013-03-19T00:00:00
db:CNNVDid:CNNVD-201212-141date:2013-03-11T00:00:00
db:NVDid:CVE-2013-1627date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:IVDid:0e010790-2353-11e6-abef-000c29c66e3ddate:2012-12-12T00:00:00
db:CNVDid:CNVD-2012-7470date:2012-12-17T00:00:00
db:VULHUBid:VHN-61629date:2013-03-11T00:00:00
db:BIDid:56871date:2012-12-04T00:00:00
db:JVNDBid:JVNDB-2013-001864date:2013-03-19T00:00:00
db:CNNVDid:CNNVD-201212-141date:2012-12-12T00:00:00
db:NVDid:CVE-2013-1627date:2013-03-11T17:55:01.810