CVE:CVE-2017-13997
CNNVD:CNNVD-201709-1090
Schneider Electric InduSoft Web Studio和InTouch Machine Edition都是法国施耐德电气（Schneider Electric）公司的嵌入式HMI软件包。该产品为HMI客户端提供读取、写入标签和事件监控功能。
Schneider Electric InduSoft Web Studio 8.0 SP2及之前的版本和InTouch Machine Edition 8.0 SP2及之前的版本中存在身份验证绕过漏洞。远程攻击者可利用该漏洞绕过身份验证机制，执行任意命令，可能控制服务器。
solution:Upgrade schneider-electric wonderware_indusoft_web_studio to a higher version than *:sp2,and avoid the version *:sp2; Upgrade schneider-electric wonderware_intouch to a higher version than *:sp2,and avoid the version *:sp2