Paper/Archive/CVE-2023-0755

CVE-2023-0755

PTC ThingWorx Edge C-SDK — The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remo…

EPSS 12%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 96.1.961 × 2019.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.

Affected

ProductAffectedFixed inSource

ThingWorx Edge C-SDK≤ v2.2.12.1052 –CNA

.NET-SDK≤ v5.8.4.971 –CNA

ThingWorx Edge MicroServer (EMS)≤ v5.4.10.0 –CNA

Kepware KEPServerEX≤ v6.12 –CNA

ThingWorx Kepware Server≤ v6.12 –CNA

ThingWorx Industrial ConnectivityAll Versions –CNA

ThingWorx Kepware Edge≤ v1.5–CNA

KEPServer Enterprise≤ v6.12–CNA

Digital Industrial Gateway Server≤ v7.612–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-23-054-01