Paper/Archive/CVE-2020-27263

CVE-2020-27263

icscert — KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All…

EPSS 6%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 93.3.933 × 2018.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.

Affected

ProductAffectedFixed inSource

PTC Kepware KEPServerEXv6.0 to v6.9–CNA

ThingWorx Kepware Serverv6.8 and v6.9–CNA

ThingWorx Industrial ConnectivityAll versions–CNA

OPC-AggregatorAll versions–CNA

Rockwell Automation KEPServer EnterpriseAll versions–CNA

GE Digital Industrial Gateway Serverv7.68.804–CNA

GE Digital Industrial Gateway Serverv7.66–CNA

Software Toolbox TOP ServerAll 6.x versions–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

refus-cert.cisa.gov/ics/advisories/icsa-20-352-02