---
id: "CVE-2014-0780"
kind: "vulnerability"
aliases: ["CVE-2014-0780"]
title: "InduSoft Web Studio: InduSoft Web Studio NTWebServer Directory Traversal Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.74679
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "InduSoft Web Studio", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "indusoft", "industrial-control", "infrastructure", "scada", "windows"]
not_affected_if: ["no-indusoft-web-studio"]
published_at: "2014-04-25T05:12:07+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0780", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2014-0780", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0780", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# InduSoft Web Studio: InduSoft Web Studio NTWebServer Directory Traversal Vulnerability

InduSoft Web Studio's built-in NTWebServer has a directory traversal flaw that lets remote attackers read files outside the web root. The sources say attackers can read administrative passwords stored in APP files and use them to run code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:InduSoft Web Studio affected ? fixed ?

## Fix

Apply the vendor update per CISA's required action; the specific fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0780
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2014-0780
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2014-0780

## From the sources

InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_