Skip to main content

Thingworx Industrial Connectivity CVE-2023-0754

CRITICAL
Integer Overflow or Wraparound (CWE-190)
2023-02-23 ics-cert@hq.dhs.gov
RCE Integer Overflow Thingworx Industrial Connectivity Kepserver Enterprise Digital Industrial Gateway Server Kepware Server Kepware Serverex Thingworx Net Sdk Thingworx Edge C Sdk Thingworx Edge Microserver Thingworx Kepware Edge Rockwellautomation Ptc Ge
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Feb 23, 2023 - 22:15 nvd
CRITICAL 9.8

DescriptionNVD

The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the server and remotely execute arbitrary code.

AnalysisAI

The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Integer Overflow (CWE-190), which allows attackers to cause unexpected behavior through arithmetic overflow. The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code. Affected products include: Ge Digital Industrial Gateway Server, Ptc Kepware Server, Ptc Kepware Serverex, Ptc Thingworx .Net-Sdk, Ptc Thingworx Edge C-Sdk.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate arithmetic operations, use safe integer libraries, check bounds before allocation.

More in Thingworx Industrial Connectivity

View all
CVE-2023-0755 CRITICAL
9.8 Feb 23

The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash th
CVE-2023-5908 CRITICAL
9.1 Nov 30

KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak i
CVE-2023-29445 HIGH
7.8 Jan 10

An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authent
CVE-2023-5909 HIGH
7.5 Nov 30

KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect. Rated
CVE-2023-29444 MEDIUM
6.3 Jan 10

An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authent
CVE-2023-29447 MEDIUM
5.7 Jan 10

An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credential
CVE-2023-29446 MEDIUM
4.7 Jan 10

An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

CVE-2023-0754 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy