PatchTheCVECVE-2017-13997: A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio
CVE-2017-13997 is a critical-severity flaw (CVSS 9.8) affecting wonderware indusoft web studio, wonderware intouch. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes of performing customized calculations or actions. A remote malicious entity could bypass the server authentication and trigger the execution of an arbitr
Why this priority
- Critical severity
- EPSS top 8%: very likely to be exploited
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 5.1% (top 8%) |
| CISA exploited list | No |
| Weakness | CWE-306 |
| Published | 2017-10-03 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-13997?
wonderware indusoft web studio: upgrade to newer than 8.0; wonderware intouch: upgrade to newer than 8.0. Exact commands for each OS are on this page.
Is CVE-2017-13997 being exploited?
CVE-2017-13997 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-13997 affect?
CVE-2017-13997 affects wonderware indusoft web studio, wonderware intouch. Severity is critical (CVSS 9.8). A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to
How urgent is CVE-2017-13997?
Priority 62/100. Critical severity; EPSS top 8%: very likely to be exploited; Remotely exploitable, no login, no user action
Software pages
Schneider Electric vulnerabilities
Related CVEs
- CVE-2017-7968 HIGH 7.8 UPGRADE An Incorrect Default Permissions issue was discovered in Schneider Electric Wonderware InduSoft Web Studio v8.
- CVE-2017-14024 CRITICAL 9.8 UPGRADE UPGRADE A Stack-based Buffer Overflow issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 Patch 1