InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2.

published 2018-11-02 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-9655

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 4.6%; EPSS 4.6% chance of exploitation in 30 days, percentile 91%
public exploits: 0; none known

InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as that of the InduSoft Web Studio or InTouch Edge HMI (formerly InTouch Machine Edition) runtime.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-18-305-01 updated 2018-11-01 cvss 9.8

AVEVA InduSoft Web Studio and InTouch Edge HMI (formerly InTouch Machine Edition)

AVEVA Software, LLC InduSoft Web Studio <8.1 SP2 AVEVA Software, LLC InTouch Edge HMI (formerly InTouch Machine Edition) <2017 SP2
affected: vendor fix, mitigation “InduSoft Web Studio prior to v8.1 SP2” softwaresupportsp.schneider-electric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

4.57% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

tenable.com https://www.tenable.com/security/research/tra-2018-34 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

unknown InduSoft Web Studio, and InTouch Edge HMI (formerly InTouch Machine Edition)

Classification

Weakness

CWE-258 Empty Password in Configuration File

References

tenable.com /security/research/tra-2018-34
exploit, third-party-advisory
ics-cert.us-cert.gov /advisories/ICSA-18-305-01
mitigation, third-party-advisory, us-government-resource

Sources

CVE List CVE-2018-17914
NVD CVE-2018-17914

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary