CVE-2011-4051 EXPLOIT
10.0
HIGH · CVSS 2.0 · EPSS 69.1% (pctl 99)
Patch early
A public exploit exists.
Description
CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attackers to execute arbitrary code via vectors related to creation of a file, loading a DLL, and process control.
Scoring
| CVSS | 10.0 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| EPSS | 69.1% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-287 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2011-12-05 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| indusoft | web studio |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | InduSoft Web Studio - Arbitrary File Upload / Remote Code Execution (Metasploit) | 2012-10-10 |
References
- http://www.indusoft.com/hotfixes/hotfixes.php
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-319-01.pdf
- http://www.zerodayinitiative.com/advisories/ZDI-11-330/
- http://www.indusoft.com/hotfixes/hotfixes.php
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-319-01.pdf
- http://www.zerodayinitiative.com/advisories/ZDI-11-330/
→ the Explorer · watch your stack · NVD