Thingworx Kepware Server
CVE-2023-5908
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.
AnalysisAI
KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-122. KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information. Affected products include: Ge Industrial Gateway Server, Ptc Keepserverex, Ptc Opc-Aggregator, Ptc Thingworx Industrial Connectivity, Ptc Thingworx Kepware Edge.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Thingworx Kepware Server
View allAn uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authent
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect. Rated
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authent
An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credential
An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today