Thingworx Kepware Server
CVE-2023-5909
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.
AnalysisAI
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-297. KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect. Affected products include: Ge Industrial Gateway Server, Ptc Keepserverex, Ptc Opc-Aggregator, Ptc Thingworx Industrial Connectivity, Ptc Thingworx Kepware Edge.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Thingworx Kepware Server
View allKEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak i
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authent
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authent
An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credential
An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today