{"cve":"CVE-2017-13997","nvd":{"published":"2017-10-03T01:29:01.857","modified":"2026-06-17T01:05:24.833","status":"Modified","description":"A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes of performing customized calculations or actions. A remote malicious entity could bypass the server authentication and trigger the execution of an arbitrary command. The command is executed under high privileges and could lead to a complete compromise of the server.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-306"],"references":["http://www.securityfocus.com/bid/100952","https://ics-cert.us-cert.gov/advisories/ICSA-17-264-01","http://www.securityfocus.com/bid/100952","https://ics-cert.us-cert.gov/advisories/ICSA-17-264-01"],"products":["schneider-electric:wonderware_indusoft_web_studio","schneider-electric:wonderware_intouch"],"source":"nvd","synced_at":"2026-10-19T20:46:01.145313090+00:00"},"epss":{"cve":"CVE-2017-13997","score":0.05053,"percentile":0.92305,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}