CVE:CVE-2018-17914
CNNVD:CNNVD-201811-020
Schneider Electric InduSoft Web Studio和InTouch Edge HMI（前称InTouch Machine Edition）都是法国施耐德电气（Schneider Electric）公司的嵌入式HMI软件包。该产品为HMI客户端提供读取、写入标签和事件监控功能。
Schneider Electric InduSoft Web Studio 8.1 SP2之前版本和InTouch Edge HMI 2017 SP2之前版本中存在安全漏洞。远程攻击者可利用该漏洞执行代码。
solution:Upgrade aveva indusoft_web_studio to a higher version than 6.1:sp5,6.1:sp6_p3,7.1,7.1:sp1,7.1:sp2,7.1:sp3,7.1:sp3_p1,7.1:sp3_p2,7.1:sp3_p3,7.1:sp3_p4,7.1:sp3_p5,7.1:sp3_p6,7.1:sp3_p7,7.1:sp3_p8,7.1:sp3_p9,8.0,8.0:p1,8.0:p2,8.0:p3,8.0:sp1,8.0:sp1_p1,8.0:sp2,8.0:sp2_p1,8.1,8.1:p1,8.1:sp1,8.1:sp1_p1,and avoid the version 6.1:sp5,6.1:sp6_p3,7.1,7.1:sp1,7.1:sp2,7.1:sp3,7.1:sp3_p1,7.1:sp3_p2,7.1:sp3_p3,7.1:sp3_p4,7.1:sp3_p5,7.1:sp3_p6,7.1:sp3_p7,7.1:sp3_p8,7.1:sp3_p9,8.0,8.0:p1,8.0:p2,8.0:p3,8.0:sp1,8.0:sp1_p1,8.0:sp2,8.0:sp2_p1,8.1,8.1:p1,8.1:sp1,8.1:sp1_p1; Upgrade aveva edge to a higher version than 8.1,8.1:sp1,and avoid the version 8.1,8.1:sp1; Upgrade aveva intouch_machine_edition_2014 to a higher version than r2,and avoid the version r2