by Kastro
Paper/Archive/CVE-2023-0754

CVE-2023-0754

PTC ThingWorx Edge C-SDK — The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the server and remotel…

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 87.1.871 × 2017.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the server and remotely execute arbitrary code.

Affected

ProductAffectedFixed inSource
ThingWorx Edge C-SDK≤ v2.2.12.1052 –CNA
.NET-SDK≤ v5.8.4.971 –CNA
ThingWorx Edge MicroServer (EMS)≤ v5.4.10.0 –CNA
Kepware KEPServerEX≤ v6.12 –CNA
ThingWorx Kepware Server≤ v6.12 –CNA
ThingWorx Industrial ConnectivityAll Versions –CNA
ThingWorx Kepware Edge≤ v1.5–CNA
KEPServer Enterprise≤ v6.12–CNA
Digital Industrial Gateway Server≤ v7.612–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-23-054-01