Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

iniNet Webserver before V2.02.0100 may let attackers bypass login

CVE-2017-13995 · published 9 years ago
Summary

The iniNet Webserver versions earlier than V2.02.0100 do not correctly verify user credentials, so an attacker could view or change critical control system pages and data. This could expose sensitive information or allow unauthorized changes to programmable logic controller settings. Upgrade to version V2.02.0100 or later, and apply any available security patches, while limiting network access to the web server.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
spidercontrol ininet_webserver <= 2.02.0000
cpe:2.3:a:spidercontrol:ininet_webserver:*:*:*:*:*:*:*:*
Original advisory text
An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authenticate users, which may allow a malicio...
An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authenticate users, which may allow a malicious attacker to access sensitive information such as HMI pages or modify PLC variables.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published5 Oct 2017
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-13995 · NVD
Track software like this
Free during beta