CVE-2014-0780 in indusoft web studio

Update InduSoft Web Studio to 7.1 SP2 Patch 4 and stop the NTWebServer demo web server

Patch or upgrade. InduSoft Web Studio 7.1 SP2 Patch 4 fixes the NTWebServer directory traversal that lets anyone read project (APP) files with passwords. NTWebServer is a demo and training server that should not run in production, so stopping it removes the risk as well.

Applies to: InduSoft Web Studio 7.1 before Service Pack 2 Patch 4, when the NTWebServer web server runs.

1. List every engineering workstation and SCADA/HMI server that runs InduSoft Web Studio (also as a component in another vendor's HMI product) and note the version in Help, About.
2. Log in to your InduSoft (now AVEVA) account and download InduSoft Web Studio 7.1 Service Pack 2 Patch 4 (IWS71.2.4) from the vendor download site.
3. Plan a maintenance window with the process owner, back up the project folders, then install Patch 4 on each host and reopen the project to confirm it loads.
4. Check whether NTWebServer.exe runs (Task Manager, Details, or 'tasklist | findstr /i NTWebServer'). If it runs, stop it and remove it from startup; serve web thin clients with IIS as InduSoft documents instead.
5. Block inbound HTTP (TCP 80 and any other port NTWebServer listens on) to the HMI hosts at the firewall, from both the business network and the internet.
6. Because the project files may already have been read, change the InduSoft Web Studio project and user passwords after patching.
7. Keep the control network behind a firewall, separate from the business network, and allow remote access only through a VPN.

Sources:

• https://www.cisa.gov/news-events/ics-advisories/icsa-14-107-02
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0780