iniNet Solutions SpiderControl SCADA PC HMI Editor Path Traversal
Priority MEDIUM 40CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability. When the software loads a malicious ‘ems' project template file constructed by an attacker, it can write files to arbitrary directories. This can lead to overwriting system files, causing system paralysis, or writing to startup items, resulting in remote control.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.005 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| iniNet Solutions | SpiderControl SCADA PC HMI Editor | 8.10.00.00 | — | No fix listed | CNA |
- SpiderControl SCADA PC HMI Editor VendoriniNet Solutions Affected 8.10.00.00 Fixed in — No fix listed CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:spidercontrol:scada_pc_hmi_editor:*:*:*:*:*:*:*:* | — | — | SpiderControl |
- cpe:2.3:a:spidercontrol:scada_pc_hmi_editor:*:*:*:*:*:*:*:* Versions — — ·SpiderControl
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-10313
- 2026-10-03 Alias added: GHSA-hqr5-gxvv-5ff4
References
More iniNet Solutions vulnerabilities
- TI-2024-07631 iniNet Solutions SpiderControl SCADA Web Server Unrestricted Upload of File with Dangerous Type CVSS 4.0HIGH 8.7
- TI-2015-00914 Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before… CVSS 2.0HIGH 10.0
- TI-2015-00915 IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which… CVSS 2.0MEDIUM 6.4
- TI-2015-00916 Directory traversal vulnerability in IniNet embeddedWebServer (aka eWebServer) before… CVSS 2.0MEDIUM 5.0
- TI-2015-00917 IniNet embeddedWebServer (aka eWebServer) before 2.02 for Windows CE uses cleartext for… CVSS 2.0LOW 2.1
Sources
- CVE-2024-10313 · CVE Program
- CVE-2024-10313 · NVD
- FIRST EPSS
- GHSA-hqr5-gxvv-5ff4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences