How to Fix CVE-2014-0780: Path Traversal in InduSoft Web Studio

Actively exploited. Listed in the CISA Known Exploited Vulnerabilities catalog since 2022-04-15; federal civilian agencies must remediate by 2022-05-06. Patch on an emergency cycle if the system is internet-exposed.

What is CVE-2014-0780?

CVE-2014-0780 is a directory-traversal (path-traversal) bug in NTWebServer, the small bundled web server that ships with InduSoft Web Studio 7.1. InduSoft Web Studio is a SCADA/HMI development suite used to build operator screens and supervisory control applications for industrial environments. The flaw, found by the Zero Day Initiative and tracked in CISA advisory ICSA-14-107-02, lets a remote attacker fetch files that sit outside the web root by crafting requests with traversal sequences. The original record describes it plainly: a directory-traversal vulnerability in NTWebServer that allows remote attackers to read administrative passwords stored in APP files, and from there reach arbitrary code execution, through unspecified web requests.

The mechanism is classic CWE-22. NTWebServer takes a path from the incoming HTTP request and uses it to locate a file on disk without properly canonicalising or constraining that path to the intended directory. Feed it a relative path that climbs out of the web root and it happily serves whatever it can read. The high-value target here is the application's .APP project files, which can hold administrative credentials for the runtime. Read those, recover the admin password, and you have the keys to the HMI runtime, which is why the record chains the file read all the way to code execution.

The attack precondition is the worst kind for an exposed service. The CVSS v2 vector is AV:N/AC:L/Au:N/C:P/I:P/A:P: network reachable, low attack complexity, and no authentication required. There is no user-interaction step and no privilege you need to hold first. Anyone who can reach the NTWebServer TCP port can send the malicious request. CISA's later CVSS v3.1 assessment scored it AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H for a 9.8: the same unauthenticated network reach, but with high confidentiality, integrity and availability impact once code execution is in play.

One nuance worth stating plainly: InduSoft has said NTWebServer was never meant for production. It was shipped as demonstration and training software, a point made in the product manuals. That does not make the CVE harmless. Plenty of real deployments left the demo server running and reachable, which is exactly why this landed in the KEV catalog.

Am I affected?

You are affected if you run InduSoft Web Studio 7.1 before Service Pack 2 Patch 4 and the NTWebServer component is installed or running. The fixed build is 7.1 + SP2 + Patch 4, which the vendor numbers as 7.1.2.4.

To check the installed version on a Windows engineering or runtime station:

1. Open the InduSoft Web Studio IDE and read the version from Help → About. You want to see the service pack and patch level, not just the 7.1 base.
2. Or inspect the installed program from Control Panel → Programs and Features, where the InduSoft Web Studio entry shows its version string.
3. Or read the file version directly from the installed executables under the InduSoft program directory (typically beneath C:\Program Files (x86)\InduSoft Web Studio v7.1) using the PowerShell snippet in the fix section below.

Then confirm whether NTWebServer is actually exposed. It listens as its own HTTP service; if it is bound to a network interface that reaches operators, contractors, or worse, the corporate network or internet, treat the host as exploitable right now. A station that has 7.1 base but never enabled or exposed the demo web server is lower urgency, but you should still patch and disable the server.

Why this CVE matters

The impact here is not a polite information leak. Reading the .APP project files hands an attacker administrative passwords for the runtime, and the record states the file read leads to arbitrary code execution. In CVSS v2 terms the confidentiality, integrity and availability impacts are each rated PARTIAL; CISA's v3.1 reassessment pushes all three to HIGH for the 9.8 score, reflecting the full takeover that follows once admin credentials and code execution are on the table.

Who is exposed? Sites running InduSoft Web Studio 7.1 where NTWebServer is enabled and reachable. Because this is HMI/SCADA software, the host often sits close to physical process control. A path-traversal read that exposes credentials on that kind of station is not just a data problem; it is a path toward manipulating an operator interface for industrial equipment. That risk profile is exactly why ICS-CERT issued ICSA-14-107-02 and why CISA later promoted the CVE into the Known Exploited Vulnerabilities catalog in 2022, mandating remediation across U.S. federal civilian agencies.

The vulnerability needs no credentials and no clicks. A single crafted HTTP request to an exposed NTWebServer port is enough, which makes it trivially automatable. CISA's SSVC decision data marks it Automatable: yes, Technical Impact: total, Exploitation: active. A working exploit for it is publicly catalogued on Exploit-DB. Treat any internet- or plant-network-reachable instance as a live target.

How to fix CVE-2014-0780

InduSoft Web Studio is a Windows desktop and runtime product, so the fix is a vendor patch package. There is no Linux distribution package, container image, or Windows package-manager listing to upgrade. InduSoft published the mitigation as InduSoft Web Studio v7.1 + Service Pack 2 + Patch 4, distributed as a ZIP from the vendor download portal (you must be signed in to your InduSoft account). The original ICS-CERT advisory and the vendor solution note both point to the same file: http://download.indusoft.com/71.2.4/IWS71.2.4.zip.

Do this in order, on a maintenance window for the engineering or runtime station:

1. Back up the project first. Copy the entire InduSoft project directory and the .APP file off the host before touching anything. SCADA project state is not something you want to lose to a botched patch.
2. Stop the runtime and the NTWebServer service so files are not locked during the update.
3. Download SP2 Patch 4 (build 7.1.2.4) from the InduSoft portal after logging in. If your download link differs from the one above, take it from ICS-CERT advisory ICSA-14-107-02 or contact InduSoft support at [email protected].
4. Apply Service Pack 2 first, then Patch 4, following the readme inside the ZIP. The patch level matters: 7.1 base or 7.1 SP2 without Patch 4 is still vulnerable.
5. Restart and confirm the version reads 7.1.2.4 (SP2 Patch 4) in Help → About.

Check the installed version with PowerShell

Run this on the Windows station to read the InduSoft Web Studio file version before and after patching. Adjust the path if your installation directory differs.

# Read the InduSoft Web Studio version from the installed binaries
$base = "C:\Program Files (x86)\InduSoft Web Studio v7.1"
if (Test-Path $base) {
    Get-ChildItem $base -Recurse -Filter *.exe -ErrorAction SilentlyContinue |
        Select-Object Name, @{n='Version';e={$_.VersionInfo.FileVersion}} |
        Sort-Object Version -Descending | Select-Object -First 10
} else {
    Write-Warning "InduSoft Web Studio v7.1 not found under the default path. Check Programs and Features for the install location."
}

# Also list the registered program entry and its version
Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
                 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -like '*InduSoft*' } |
    Select-Object DisplayName, DisplayVersion

After applying SP2 Patch 4, the reported version should reflect build 7.1.2.4. If it still shows the base 7.1 build, the patch did not land, so re-run the readme steps.

If you can't patch immediately

NTWebServer was shipped as demonstration and training software, not for production use; InduSoft says so in the manuals. That gives you a strong compensating control: if you are not actively using the demo web server, turn it off and keep it off. A disabled NTWebServer cannot be traversed.

• Disable NTWebServer entirely if no operator screen actually relies on it. Stop the service and set it not to auto-start. This removes the attack surface, not just narrows it.
• Block the listening port at the host firewall and only allow the small set of engineering stations that genuinely need it. Industrial HMI traffic should never be internet-reachable.
• Segment the SCADA network so the runtime station is not flat with the corporate LAN. Standard ICS hardening: put it behind a controlled boundary with explicit allow rules.
• Rotate the runtime admin credentials stored in the .APP file, on the assumption that an exposed host may already have leaked them.

Use Windows Firewall to block the NTWebServer port on the runtime station while you stage the patch. Replace <port> with the port NTWebServer is bound to and <engineering-cidr> with your authorised station subnet:

# Block all inbound to the NTWebServer port, then allow only the engineering subnet
New-NetFirewallRule -DisplayName 'Block-NTWebServer-CVE-2014-0780' -Direction Inbound -Action Block -Protocol TCP -LocalPort <port>
New-NetFirewallRule -DisplayName 'Allow-NTWebServer-Eng-Only' -Direction Inbound -Action Allow -Protocol TCP -LocalPort <port> -RemoteAddress <engineering-cidr>

How to verify the fix worked

1. Open Help → About in InduSoft Web Studio and confirm the build reads 7.1 SP2 Patch 4 (7.1.2.4). Re-run the PowerShell version check above; the binaries must report the patched build, not base 7.1.
2. Test the traversal directly. From a non-production client, send a request that attempts to climb out of the web root toward a known file; on a patched NTWebServer the request must be rejected rather than serving file contents. Do this only against systems you own and control.
3. If NTWebServer was disabled as your remediation, confirm the service is stopped and set to not auto-start, and that the port no longer accepts connections.
4. If the host may have been exposed before patching, treat the runtime admin credentials in the .APP file as compromised: rotate them, and review NTWebServer access logs for traversal-style request paths predating the fix. Any match before the patch timestamp warrants an incident review of that station.

Is CVE-2014-0780 being exploited right now?

Yes. CVE-2014-0780 is in the CISA Known Exploited Vulnerabilities catalog, added 2022-04-15, and CISA's SSVC data marks its exploitation state as active. A public exploit is also catalogued on Exploit-DB. Treat any reachable InduSoft Web Studio 7.1 instance with NTWebServer enabled as a live target.

What is the fixed version for CVE-2014-0780?

InduSoft Web Studio 7.1 + Service Pack 2 + Patch 4 (build 7.1.2.4). Apply SP2 first, then Patch 4. Base 7.1 and 7.1 SP2 without Patch 4 remain vulnerable.

What is the CVSS score for CVE-2014-0780?

The original CVSS v2 base score is 7.5 (High), vector AV:N/AC:L/Au:N/C:P/I:P/A:P. CISA later assigned a CVSS v3.1 score of 9.8 (Critical), reflecting unauthenticated network reach plus high confidentiality, integrity, and availability impact.

Can I just disable the web server instead of patching?

For the short term, yes. NTWebServer was shipped as demonstration/training software, not for production. If no operator screen depends on it, stop the service and disable auto-start to remove the attack surface, then apply SP2 Patch 4 on your next maintenance window and rotate any admin credentials that the exposed station may have leaked.

References

• ICS-CERT advisory ICSA-14-107-02 (authoritative advisory): https://www.cisa.gov/news-events/ics-advisories/icsa-14-107-02
• InduSoft Web Studio 7.1.2.4 patch (SP2 Patch 4, login required): http://download.indusoft.com/71.2.4/IWS71.2.4.zip
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2014-0780
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0780
• Public exploit (Exploit-DB 42699): https://www.exploit-db.com/exploits/42699/
• SecurityFocus BID 67056: http://www.securityfocus.com/bid/67056
• Legacy ICS-CERT URL: http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02

This guide was assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Related weaknesses in the same component worth addressing at the same time:

• How to Fix CVE-2014-3120: Improper Access Control in Elastic Elasticsearch
• How to Fix CVE-2014-0130: Path Traversal in Rails Ruby on Rails
• How to Fix CVE-2014-7169: OS command injection in Bash
• How to Fix CVE-2014-6271: OS command injection in Bash
• How to Fix CVE-2014-6287: Code Injection in Rejetto HTTP File Server (HFS)