Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
94 vulnerabilities by ptc
CVE-2026-77646 (GCVE-0-2026-77646)
Vulnerability from nvd – Published: 2026-08-20 22:11 – Updated: 2026-08-21 20:08
VLAI
EPSS
VEX
Title
Server Side Request Forgery (SSRF) vulnerability reported in Windchill
Summary
A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:49 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ptc.com/en/support/article/CS474826 | vendor-advisorymitigationpermissions-required |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Windchill PDMLink |
Affected:
11.0 M030
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.2.0 Affected: 12.1.2.0 Affected: 13.0.2.0 Affected: 13.1.0.0 Affected: 13.1.1.0 Affected: 13.1.2.0 Affected: 13.1.3.0 |
|
| PTC | FlexPLM |
Affected:
11.0 M030
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.0.0 Affected: 12.0.2.0 Affected: 12.0.3.0 Affected: 12.1.2.0 Affected: 12.1.3.0 Affected: 13.0.2.0 Affected: 13.0.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77646",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:49:33.203565Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T20:08:38.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Windchill PDMLink",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.1.0.0"
},
{
"status": "affected",
"version": "13.1.1.0"
},
{
"status": "affected",
"version": "13.1.2.0"
},
{
"status": "affected",
"version": "13.1.3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FlexPLM",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.0.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.0.3.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "12.1.3.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.0.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Richard Clifford of Rootshell Security (https://www.rootshellsecurity.net/)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A\u0026nbsp;\u003cspan\u003eServer-Side Request Forgery (SSRF) \u003c/span\u003e\u003cspan\u003evulnerability has been\u0026nbsp;\u003c/span\u003e\u003cspan\u003ereported in PTC Windchill PDMLink and PTC FlexPLM\u003c/span\u003e\u003cspan\u003e. \u003c/span\u003e\u003cspan\u003eThe vulnerability may be exploited through the deserialization of untrusted data.\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e"
}
],
"value": "A\u00a0Server-Side Request Forgery (SSRF) vulnerability has been\u00a0reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
},
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/R:U/V:D/RE:M/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of untrusted data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T22:11:25.150Z",
"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"shortName": "PTC"
},
"references": [
{
"tags": [
"vendor-advisory",
"mitigation",
"permissions-required"
],
"url": "https://www.ptc.com/en/support/article/CS474826"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Server Side Request Forgery (SSRF) vulnerability reported in Windchill",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"assignerShortName": "PTC",
"cveId": "CVE-2026-77646",
"datePublished": "2026-08-20T22:11:25.150Z",
"dateReserved": "2026-08-20T22:07:22.899Z",
"dateUpdated": "2026-08-21T20:08:38.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77645 (GCVE-0-2026-77645)
Vulnerability from nvd – Published: 2026-08-20 22:08 – Updated: 2026-08-22 03:55
VLAI
EPSS
VEX
Title
Critical Remote Code Execution (RCE) vulnerability reported in Windchill
Summary
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 00:00 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ptc.com/en/support/article/CS474826 | vendor-advisorymitigationpermissions-required |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Windchill PDMLink |
Affected:
11.0 M030
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.2.0 Affected: 12.1.2.0 Affected: 13.0.2.0 Affected: 13.1.0.0 Affected: 13.1.1.0 Affected: 13.1.2.0 Affected: 13.1.3.0 |
|
| PTC | FlexPLM |
Affected:
11.0 M030
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.0.0 Affected: 12.0.2.0 Affected: 12.0.3.0 Affected: 12.1.2.0 Affected: 12.1.3.0 Affected: 13.0.2.0 Affected: 13.0.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77645",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T03:55:42.259Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Windchill PDMLink",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.1.0.0"
},
{
"status": "affected",
"version": "13.1.1.0"
},
{
"status": "affected",
"version": "13.1.2.0"
},
{
"status": "affected",
"version": "13.1.3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FlexPLM",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.0.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.0.3.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "12.1.3.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.0.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Arthur Aires (https://arthurair.es/)"
},
{
"lang": "en",
"type": "reporter",
"value": "brenocss (LinkedIn: @brenocss)"
},
{
"lang": "en",
"type": "reporter",
"value": "Bruno Milreu (LinkedIn: @bruno-milreu)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."
}
],
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
},
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of untrusted data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T22:08:41.642Z",
"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"shortName": "PTC"
},
"references": [
{
"tags": [
"vendor-advisory",
"mitigation",
"permissions-required"
],
"url": "https://www.ptc.com/en/support/article/CS474826"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Critical Remote Code Execution (RCE) vulnerability reported in Windchill",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"assignerShortName": "PTC",
"cveId": "CVE-2026-77645",
"datePublished": "2026-08-20T22:08:41.642Z",
"dateReserved": "2026-08-20T22:07:21.684Z",
"dateUpdated": "2026-08-22T03:55:42.259Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77644 (GCVE-0-2026-77644)
Vulnerability from nvd – Published: 2026-08-20 21:54 – Updated: 2026-08-26 14:15
VLAI
EPSS
VEX
Title
Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition
Summary
A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-22 03:56 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ptc.com/en/support/article/CS474818 | vendor-advisorypermissions-required |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Windchill Risk and Reliability Enterprise Edition (Formerly Relex) |
Affected:
11.1 , ≤ 13.1
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77644",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-22T03:56:19.515879Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:15:58.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Windchill Risk and Reliability Enterprise Edition (Formerly Relex)",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "13.1",
"status": "affected",
"version": "11.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Romain J. of Devoteam - Purple"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition."
}
],
"value": "A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition."
}
],
"impacts": [
{
"capecId": "CAPEC-36",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-36 Using Unpublished Interfaces or Functionality"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/RE:M/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620 Unverified password change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:54:48.536Z",
"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"shortName": "PTC"
},
"references": [
{
"tags": [
"vendor-advisory",
"permissions-required"
],
"url": "https://www.ptc.com/en/support/article/CS474818"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"assignerShortName": "PTC",
"cveId": "CVE-2026-77644",
"datePublished": "2026-08-20T21:54:48.536Z",
"dateReserved": "2026-08-20T21:52:32.059Z",
"dateUpdated": "2026-08-26T14:15:58.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12569 (GCVE-0-2026-12569)
Vulnerability from nvd – Published: 2026-06-18 00:11 – Updated: 2026-08-01 03:55Title
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
Summary
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions
* The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
Severity
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-25 00:00 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ptc.com/en/support/article/CS473270 | vendor-advisorymitigationpermissions-required |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Windchill PDMLink |
Affected:
0 , ≤ 11.0 M030
(semver)
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.2.0 Affected: 12.1.2.0 Affected: 13.0.2.0 Affected: 13.1.0.0 Affected: 13.1.1.0 Affected: 13.1.2.0 Affected: 13.1.3.0 |
|
| PTC | FlexPLM |
Affected:
0 , ≤ 11.0 M030
(semver)
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.0.0 Affected: 12.0.2.0 Affected: 12.1.2.0 Affected: 12.1.3.0 Affected: 13.0.2.0 Affected: 13.0.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12569",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-25T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-06-25",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T03:55:29.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Windchill PDMLink",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "11.0 M030",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.1.0.0"
},
{
"status": "affected",
"version": "13.1.1.0"
},
{
"status": "affected",
"version": "13.1.2.0"
},
{
"status": "affected",
"version": "13.1.3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FlexPLM",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "11.0 M030",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.0.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "12.1.3.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.0.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\u0026nbsp;\u003cdiv\u003e\u003cul\u003e\u003cli\u003eThis advisory also applies to all CPS versions\u003c/li\u003e\u003cli\u003eThe identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e"
}
],
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\u00a0 * This advisory also applies to all CPS versions\n * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030"
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
},
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of untrusted data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T00:11:35.241Z",
"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"shortName": "PTC"
},
"references": [
{
"tags": [
"vendor-advisory",
"mitigation",
"permissions-required"
],
"url": "https://www.ptc.com/en/support/article/CS473270"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Remote Code Execution (RCE) vulnerability in Windchill PDMlink",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"assignerShortName": "PTC",
"cveId": "CVE-2026-12569",
"datePublished": "2026-06-18T00:11:35.241Z",
"dateReserved": "2026-06-18T00:02:58.904Z",
"dateUpdated": "2026-08-01T03:55:29.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4681 (GCVE-0-2026-4681)
Vulnerability from nvd – Published: 2026-03-23 21:48 – Updated: 2026-03-24 14:49
VLAI
EPSS
VEX
Title
Critical Remote Code Execution vulnerability reported in Windchill
Summary
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-24 14:48 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ptc.com/en/about/trust-center/advisor… | vendor-advisorymitigation |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Windchill PDMLink |
Affected:
11.0 M030
(semver)
Affected: 11.1 M020 (semver) Affected: 11.2.1.0 (semver) Affected: 12.0.2.0 (semver) Affected: 12.1.2.0 (semver) Affected: 13.0.2.0 (semver) Affected: 13.1.0.0 Affected: 13.1.1.0 Affected: 13.1.2.0 Affected: 13.1.3.0 |
|
| PTC | FlexPLM |
Affected:
11.0 M030
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.0.0 Affected: 12.0.2.0 Affected: 12.0.3.0 Affected: 12.1.2.0 Affected: 12.1.3.0 Affected: 13.0.2.0 Affected: 13.0.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4681",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T14:48:53.854433Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T14:49:43.425Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Windchill PDMLink",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.1 M020",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.2.1.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "12.0.2.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "12.1.2.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "13.0.2.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "13.1.0.0"
},
{
"status": "affected",
"version": "13.1.1.0"
},
{
"status": "affected",
"version": "13.1.2.0"
},
{
"status": "affected",
"version": "13.1.3.0"
}
]
},
{
"defaultStatus": "unknown",
"product": "FlexPLM",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.0.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.0.3.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "12.1.3.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.0.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cspan\u003eA critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eThis issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\n\nThis issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T21:48:05.652Z",
"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"shortName": "PTC"
},
"references": [
{
"tags": [
"vendor-advisory",
"mitigation"
],
"url": "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability?srsltid=AfmBOop3e7Nthx5-BsrjKdpZi50wL6l6Bt21Fz0gUub2cIPgdPGV5bNl"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Critical Remote Code Execution vulnerability reported in Windchill",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"assignerShortName": "PTC",
"cveId": "CVE-2026-4681",
"datePublished": "2026-03-23T21:48:05.652Z",
"dateReserved": "2026-03-23T21:42:24.158Z",
"dateUpdated": "2026-03-24T14:49:43.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-40395 (GCVE-0-2024-40395)
Vulnerability from nvd – Published: 2024-08-27 00:00 – Updated: 2025-03-25 16:20
VLAI
EPSS
VEX
Summary
An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-27 19:29 UTC
CWE
- n/a
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://pastebin.com/9dc4LYGA |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-40395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-27T19:29:22.699052Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T16:20:43.892Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T16:03:41.459Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://pastebin.com/9dc4LYGA"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-40395",
"datePublished": "2024-08-27T00:00:00.000Z",
"dateReserved": "2024-07-05T00:00:00.000Z",
"dateUpdated": "2025-03-25T16:20:43.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6098 (GCVE-0-2024-6098)
Vulnerability from nvd – Published: 2024-08-16 14:57 – Updated: 2024-08-19 17:32
VLAI
EPSS
VEX
Title
PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling
Summary
When performing an online tag generation to devices which communicate
using the ControlLogix protocol, a machine-in-the-middle, or a device
that is not configured correctly, could deliver a response leading to
unrestricted or unregulated resource allocation. This could cause a
denial-of-service condition and crash the Kepware application. By
default, these functions are turned off, yet they remain accessible for
users who recognize and require their advantages.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-19 17:32 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Kepware ThingWorx Kepware Server |
Affected:
V6
|
|
| PTC | Kepware KEPServerEX |
Affected:
V6
|
|
| Software Toolbox | TOP Server |
Affected:
V6
|
|
| GE | IGS |
Affected:
V7.6x
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-19T17:32:29.303502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-19T17:32:48.721Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kepware ThingWorx Kepware Server",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "V6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Kepware KEPServerEX",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "V6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TOP Server",
"vendor": "Software Toolbox",
"versions": [
{
"status": "affected",
"version": "V6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IGS",
"vendor": "GE",
"versions": [
{
"status": "affected",
"version": "V7.6x"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sharon Brizinov and Vera Mens of Claroty Research - Team82 reported this vulnerability to PTC."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When performing an online tag generation to devices which communicate \nusing the ControlLogix protocol, a machine-in-the-middle, or a device \nthat is not configured correctly, could deliver a response leading to \nunrestricted or unregulated resource allocation. This could cause a \ndenial-of-service condition and crash the Kepware application. By \ndefault, these functions are turned off, yet they remain accessible for \nusers who recognize and require their advantages."
}
],
"value": "When performing an online tag generation to devices which communicate \nusing the ControlLogix protocol, a machine-in-the-middle, or a device \nthat is not configured correctly, could deliver a response leading to \nunrestricted or unregulated resource allocation. This could cause a \ndenial-of-service condition and crash the Kepware application. By \ndefault, these functions are turned off, yet they remain accessible for \nusers who recognize and require their advantages."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-16T14:57:51.023Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-11"
},
{
"url": "https://www.ptc.com/en/support/article/CS423892"
}
],
"source": {
"advisory": "ICSA-24-228-11",
"discovery": "EXTERNAL"
},
"title": "PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PTC recommends users take a defense-in-depth stance with regards to \ntheir manufacturing networks ensuring proper access control is \nmaintained. Additionally, proper adherence to the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ptc.com/support/-/media/support/refdocs/ThingWorx_Kepware_Server/6,-d-,16/secure_deployment_guide_tks.pdf?sc_lang=en\u0026amp;source=search\"\u003eKepware Secure Deployment Guide\u003c/a\u003e\u003cp\u003e will minimize this threat through accurate configuration and use of the product.\u003c/p\u003e\n\u003cp\u003ePlease refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ptc.com/en/support/article/CS423892\"\u003ethis article (login required)\u003c/a\u003e\u003c/p\u003e\u003cp\u003e for specific information on how this risk may be mitigated in your environment.\u003c/p\u003e\n\u003cp\u003eIf additional questions remain, contact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/apps/case_logger_viewer/cs/auth/ssl/log?\"\u003ePTC Technical Support.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "PTC recommends users take a defense-in-depth stance with regards to \ntheir manufacturing networks ensuring proper access control is \nmaintained. Additionally, proper adherence to the Kepware Secure Deployment Guide https://www.ptc.com/support/-/media/support/refdocs/ThingWorx_Kepware_Server/6,-d-,16/secure_deployment_guide_tks.pdf will minimize this threat through accurate configuration and use of the product.\n\n\nPlease refer to this article (login required) https://www.ptc.com/en/support/article/CS423892 \n\n for specific information on how this risk may be mitigated in your environment.\n\n\nIf additional questions remain, contact PTC Technical Support. https://support.ptc.com/apps/case_logger_viewer/cs/auth/ssl/log"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-6098",
"datePublished": "2024-08-16T14:57:51.023Z",
"dateReserved": "2024-06-17T21:40:20.832Z",
"dateUpdated": "2024-08-19T17:32:48.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6071 (GCVE-0-2024-6071)
Vulnerability from nvd – Published: 2024-06-27 23:05 – Updated: 2024-08-01 21:25
VLAI
EPSS
VEX
Title
PTC Creo Elements/Direct License Server Missing Authorization
Summary
PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-28 15:22 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Creo Elements/Direct License |
Affected:
0 , ≤ 20.7.0.0
(custom)
|
|
| creo | creo_elements\/direct_license |
Affected:
0 , ≤ 20.7.0.0
(custom)
cpe:2.3:a:creo:creo_elements\/direct_license:0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:creo:creo_elements\\/direct_license:0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "creo_elements\\/direct_license",
"vendor": "creo",
"versions": [
{
"lessThanOrEqual": "20.7.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6071",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-28T15:22:36.234542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-28T15:26:22.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:25:03.240Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-177-02"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.ptc.com/en/support/article/CS417607"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Creo Elements/Direct License",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "20.7.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thomas Riedmaier of Siemens Energy reported this vulnerability to PTC."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-27T23:05:03.183Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-177-02"
},
{
"url": "https://www.ptc.com/en/support/article/CS417607"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003ePTC recommends that users upgrade to Creo Elements/Direct License Server 20.7.0.1 or higher version:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CDR\"\u003eCreo Elements/Direct Drafting\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CMM\"\u003eCreo Elements/Direct Model/Drawing Mgr\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CML\"\u003eCreo Elements/Direct Modeling\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CWM\"\u003eCreo Elements/Direct WorkManager\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eIf additional questions remain, please contact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/apps/case_logger_viewer/cs/auth/ssl/log?\"\u003ePTC Technical Support.\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor more information, see \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ptc.com/en/support/article/CS417607\"\u003ePTC\u0027s CS article\u003c/a\u003e.\u003c/p\u003e\n\n"
}
],
"value": "PTC recommends that users upgrade to Creo Elements/Direct License Server 20.7.0.1 or higher version:\n\n * Creo Elements/Direct Drafting https://support.ptc.com/appserver/auth/it/esd/product.jsp \n * Creo Elements/Direct Model/Drawing Mgr https://support.ptc.com/appserver/auth/it/esd/product.jsp \n * Creo Elements/Direct Modeling https://support.ptc.com/appserver/auth/it/esd/product.jsp \n * Creo Elements/Direct WorkManager https://support.ptc.com/appserver/auth/it/esd/product.jsp \n\n\nIf additional questions remain, please contact PTC Technical Support. https://support.ptc.com/apps/case_logger_viewer/cs/auth/ssl/log \n\nFor more information, see PTC\u0027s CS article https://www.ptc.com/en/support/article/CS417607 ."
}
],
"source": {
"advisory": "ICSA-24-177-02",
"discovery": "EXTERNAL"
},
"title": "PTC Creo Elements/Direct License Server Missing Authorization",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-6071",
"datePublished": "2024-06-27T23:05:03.183Z",
"dateReserved": "2024-06-17T15:17:28.397Z",
"dateUpdated": "2024-08-01T21:25:03.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-3951 (GCVE-0-2024-3951)
Vulnerability from nvd – Published: 2024-05-08 14:38 – Updated: 2024-08-01 20:26
VLAI
EPSS
VEX
Title
Cross-site Scripting in PTC Codebeamer
Summary
PTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-08 17:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Codebeamer |
Affected:
0 , ≤ 22.10 SP9
(custom)
Affected: 0 , ≤ 2.0.0.3 (custom) Affected: 2.1.0.0 |
|
| ptc | codebeamer |
Affected:
0
cpe:2.3:a:ptc:codebeamer:0:*:*:*:*:*:*:* |
|
| ptc | codebeamer |
Affected:
2.1.0.0
cpe:2.3:a:ptc:codebeamer:2.1.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ptc:codebeamer:0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "codebeamer",
"vendor": "ptc",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:a:ptc:codebeamer:2.1.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "codebeamer",
"vendor": "ptc",
"versions": [
{
"status": "affected",
"version": "2.1.0.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-3951",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-08T17:26:49.961585Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:33:21.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:26:57.164Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Codebeamer",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "22.10 SP9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.0.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2.1.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marek Holka (ETAS) reported this vulnerability to PTC."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003ePTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code.\u003c/p\u003e\n\n"
}
],
"value": "\nPTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-08T14:38:31.791Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003ePTC released the following resolutions:\u003c/p\u003e\u003cul\u003e\u003cli\u003eCodebeamer: Update to version \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CBM\"\u003e22.10 SP10\u003c/a\u003e\u0026nbsp;or later\u003c/li\u003e\u003cli\u003eCodebeamer: Update to version \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CBM\"\u003e2.0.0.4\u003c/a\u003e\u0026nbsp;or later\u003c/li\u003e\u003cli\u003eCodebeamer: Update to version \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CBM\"\u003e2.1.0.1\u003c/a\u003e\u0026nbsp;or later\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor more information, see PTC\u0027s \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ptc.com/en/support/article/CS416309\"\u003ecustomer support article\u003c/a\u003e.\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "\nPTC released the following resolutions:\n\n * Codebeamer: Update to version 22.10 SP10 https://support.ptc.com/appserver/auth/it/esd/product.jsp \u00a0or later\n * Codebeamer: Update to version 2.0.0.4 https://support.ptc.com/appserver/auth/it/esd/product.jsp \u00a0or later\n * Codebeamer: Update to version 2.1.0.1 https://support.ptc.com/appserver/auth/it/esd/product.jsp \u00a0or later\n\nFor more information, see PTC\u0027s customer support article https://www.ptc.com/en/support/article/CS416309 .\n\n"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site Scripting in PTC Codebeamer",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-3951",
"datePublished": "2024-05-08T14:38:31.791Z",
"dateReserved": "2024-04-18T14:33:58.780Z",
"dateUpdated": "2024-08-01T20:26:57.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29447 (GCVE-0-2023-29447)
Vulnerability from nvd – Published: 2024-01-10 20:24 – Updated: 2025-06-17 20:59
VLAI
EPSS
VEX
Title
Insufficiently Protected Credentials in PTC's Kepware KEPServerEX
Summary
An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-01-11 02:38 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
| https://www.ptc.com/en/support/article/cs399528 | vendor-advisory |
| https://www.dragos.com/advisory/ptcs-kepserverex-… |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Kepware KEPServerEX |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Kepware Server |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Industrial Connectivity |
Affected:
8.0 , ≤ 8.5
(0)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:07:46.417Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-11T02:38:36.071314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-17T20:59:11.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Kepware KEPServerEX",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Kepware Server",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Industrial Connectivity",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "8.0",
"versionType": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Sam Hanson of Dragos"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication."
}
],
"value": "An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Man in the Middle Attack"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T15:45:53.226Z",
"orgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"shortName": "Dragos"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficiently Protected Credentials in PTC\u0027s Kepware KEPServerEX",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"assignerShortName": "Dragos",
"cveId": "CVE-2023-29447",
"datePublished": "2024-01-10T20:24:52.983Z",
"dateReserved": "2023-04-06T17:45:40.441Z",
"dateUpdated": "2025-06-17T20:59:11.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29446 (GCVE-0-2023-29446)
Vulnerability from nvd – Published: 2024-01-10 20:21 – Updated: 2024-11-14 17:23
VLAI
EPSS
VEX
Title
Improper Input Validation in PTC's Kepware KEPServerEX
Summary
An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-14 17:23 UTC
CWE
- CWE-40 - Path Traversal: '\\UNC\share\name\' (Windows UNC Share)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
| https://www.ptc.com/en/support/article/cs399528 | vendor-advisory |
| https://www.dragos.com/advisory/ptcs-kepserverex-… |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Kepware KEPServerEX |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Kepware Server |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Industrial Connectivity |
Affected:
8.0 , ≤ 8.5
(0)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:07:46.304Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29446",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T17:23:25.379414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T17:23:37.514Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Kepware KEPServerEX",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Kepware Server",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Industrial Connectivity",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "8.0",
"versionType": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Sam Hanson of Dragos"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.\u0026nbsp;"
}
],
"value": "An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline."
}
],
"impacts": [
{
"capecId": "CAPEC-644",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-644 Use of Captured Hashes (Pass The Hash)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-40",
"description": "CWE-40: Path Traversal: \u0027\\\\UNC\\share\\name\\\u0027 (Windows UNC Share)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-08T15:13:16.725Z",
"orgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"shortName": "Dragos"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Input Validation in PTC\u0027s Kepware KEPServerEX",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"assignerShortName": "Dragos",
"cveId": "CVE-2023-29446",
"datePublished": "2024-01-10T20:21:51.434Z",
"dateReserved": "2023-04-06T17:45:40.441Z",
"dateUpdated": "2024-11-14T17:23:37.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29445 (GCVE-0-2023-29445)
Vulnerability from nvd – Published: 2024-01-10 20:17 – Updated: 2025-06-17 20:59
VLAI
EPSS
VEX
Title
Uncontrolled Search Path Element in PTC's Kepware KEPServerEX
Summary
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-01-11 20:16 UTC
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
| https://www.ptc.com/en/support/article/cs399528 | vendor-advisory |
| https://www.dragos.com/advisory/ptcs-kepserverex-… |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Kepware KEPServerEX |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Kepware Server |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Industrial Connectivity |
Affected:
8.0 , ≤ 8.5
(0)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:07:46.126Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29445",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-11T20:16:37.750500Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-17T20:59:11.408Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Kepware KEPServerEX",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Kepware Server",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Industrial Connectivity",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "8.0",
"versionType": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Sam Hanson of Dragos"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM."
}
],
"value": "An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-10T20:17:12.837Z",
"orgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"shortName": "Dragos"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Uncontrolled Search Path Element in PTC\u0027s Kepware KEPServerEX",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"assignerShortName": "Dragos",
"cveId": "CVE-2023-29445",
"datePublished": "2024-01-10T20:17:12.837Z",
"dateReserved": "2023-04-06T17:45:40.441Z",
"dateUpdated": "2025-06-17T20:59:11.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29444 (GCVE-0-2023-29444)
Vulnerability from nvd – Published: 2024-01-10 17:06 – Updated: 2025-05-14 20:14
VLAI
EPSS
VEX
Title
Uncontrolled Search Path Element in PTC's Kepware KEPServerEX
Summary
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-14 20:14 UTC
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
| https://www.ptc.com/en/support/article/cs399528 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Kepware KEPServerEX |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Kepware Server |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Industrial Connectivity |
Affected:
8.0 , ≤ 8.5
(0)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:07:46.269Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29444",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-14T20:14:08.179087Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-14T20:14:19.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Kepware KEPServerEX",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Kepware Server",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Industrial Connectivity",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "8.0",
"versionType": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Sam Hanson of Dragos"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution."
}
],
"value": "An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-10T17:06:35.965Z",
"orgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"shortName": "Dragos"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Uncontrolled Search Path Element in PTC\u0027s Kepware KEPServerEX",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"assignerShortName": "Dragos",
"cveId": "CVE-2023-29444",
"datePublished": "2024-01-10T17:06:35.965Z",
"dateReserved": "2023-04-06T17:45:40.441Z",
"dateUpdated": "2025-05-14T20:14:19.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-77646 (GCVE-0-2026-77646)
Vulnerability from cvelistv5 – Published: 2026-08-20 22:11 – Updated: 2026-08-21 20:08
VLAI
EPSS
VEX
Title
Server Side Request Forgery (SSRF) vulnerability reported in Windchill
Summary
A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:49 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ptc.com/en/support/article/CS474826 | vendor-advisorymitigationpermissions-required |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Windchill PDMLink |
Affected:
11.0 M030
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.2.0 Affected: 12.1.2.0 Affected: 13.0.2.0 Affected: 13.1.0.0 Affected: 13.1.1.0 Affected: 13.1.2.0 Affected: 13.1.3.0 |
|
| PTC | FlexPLM |
Affected:
11.0 M030
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.0.0 Affected: 12.0.2.0 Affected: 12.0.3.0 Affected: 12.1.2.0 Affected: 12.1.3.0 Affected: 13.0.2.0 Affected: 13.0.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77646",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:49:33.203565Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T20:08:38.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Windchill PDMLink",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.1.0.0"
},
{
"status": "affected",
"version": "13.1.1.0"
},
{
"status": "affected",
"version": "13.1.2.0"
},
{
"status": "affected",
"version": "13.1.3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FlexPLM",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.0.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.0.3.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "12.1.3.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.0.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Richard Clifford of Rootshell Security (https://www.rootshellsecurity.net/)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A\u0026nbsp;\u003cspan\u003eServer-Side Request Forgery (SSRF) \u003c/span\u003e\u003cspan\u003evulnerability has been\u0026nbsp;\u003c/span\u003e\u003cspan\u003ereported in PTC Windchill PDMLink and PTC FlexPLM\u003c/span\u003e\u003cspan\u003e. \u003c/span\u003e\u003cspan\u003eThe vulnerability may be exploited through the deserialization of untrusted data.\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e"
}
],
"value": "A\u00a0Server-Side Request Forgery (SSRF) vulnerability has been\u00a0reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
},
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/R:U/V:D/RE:M/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of untrusted data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T22:11:25.150Z",
"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"shortName": "PTC"
},
"references": [
{
"tags": [
"vendor-advisory",
"mitigation",
"permissions-required"
],
"url": "https://www.ptc.com/en/support/article/CS474826"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Server Side Request Forgery (SSRF) vulnerability reported in Windchill",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"assignerShortName": "PTC",
"cveId": "CVE-2026-77646",
"datePublished": "2026-08-20T22:11:25.150Z",
"dateReserved": "2026-08-20T22:07:22.899Z",
"dateUpdated": "2026-08-21T20:08:38.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77645 (GCVE-0-2026-77645)
Vulnerability from cvelistv5 – Published: 2026-08-20 22:08 – Updated: 2026-08-22 03:55
VLAI
EPSS
VEX
Title
Critical Remote Code Execution (RCE) vulnerability reported in Windchill
Summary
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 00:00 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ptc.com/en/support/article/CS474826 | vendor-advisorymitigationpermissions-required |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Windchill PDMLink |
Affected:
11.0 M030
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.2.0 Affected: 12.1.2.0 Affected: 13.0.2.0 Affected: 13.1.0.0 Affected: 13.1.1.0 Affected: 13.1.2.0 Affected: 13.1.3.0 |
|
| PTC | FlexPLM |
Affected:
11.0 M030
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.0.0 Affected: 12.0.2.0 Affected: 12.0.3.0 Affected: 12.1.2.0 Affected: 12.1.3.0 Affected: 13.0.2.0 Affected: 13.0.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77645",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T03:55:42.259Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Windchill PDMLink",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.1.0.0"
},
{
"status": "affected",
"version": "13.1.1.0"
},
{
"status": "affected",
"version": "13.1.2.0"
},
{
"status": "affected",
"version": "13.1.3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FlexPLM",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.0.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.0.3.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "12.1.3.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.0.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Arthur Aires (https://arthurair.es/)"
},
{
"lang": "en",
"type": "reporter",
"value": "brenocss (LinkedIn: @brenocss)"
},
{
"lang": "en",
"type": "reporter",
"value": "Bruno Milreu (LinkedIn: @bruno-milreu)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."
}
],
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
},
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of untrusted data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T22:08:41.642Z",
"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"shortName": "PTC"
},
"references": [
{
"tags": [
"vendor-advisory",
"mitigation",
"permissions-required"
],
"url": "https://www.ptc.com/en/support/article/CS474826"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Critical Remote Code Execution (RCE) vulnerability reported in Windchill",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"assignerShortName": "PTC",
"cveId": "CVE-2026-77645",
"datePublished": "2026-08-20T22:08:41.642Z",
"dateReserved": "2026-08-20T22:07:21.684Z",
"dateUpdated": "2026-08-22T03:55:42.259Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77644 (GCVE-0-2026-77644)
Vulnerability from cvelistv5 – Published: 2026-08-20 21:54 – Updated: 2026-08-26 14:15
VLAI
EPSS
VEX
Title
Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition
Summary
A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-22 03:56 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ptc.com/en/support/article/CS474818 | vendor-advisorypermissions-required |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Windchill Risk and Reliability Enterprise Edition (Formerly Relex) |
Affected:
11.1 , ≤ 13.1
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77644",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-22T03:56:19.515879Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:15:58.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Windchill Risk and Reliability Enterprise Edition (Formerly Relex)",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "13.1",
"status": "affected",
"version": "11.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Romain J. of Devoteam - Purple"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition."
}
],
"value": "A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition."
}
],
"impacts": [
{
"capecId": "CAPEC-36",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-36 Using Unpublished Interfaces or Functionality"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/RE:M/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620 Unverified password change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:54:48.536Z",
"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"shortName": "PTC"
},
"references": [
{
"tags": [
"vendor-advisory",
"permissions-required"
],
"url": "https://www.ptc.com/en/support/article/CS474818"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"assignerShortName": "PTC",
"cveId": "CVE-2026-77644",
"datePublished": "2026-08-20T21:54:48.536Z",
"dateReserved": "2026-08-20T21:52:32.059Z",
"dateUpdated": "2026-08-26T14:15:58.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12569 (GCVE-0-2026-12569)
Vulnerability from cvelistv5 – Published: 2026-06-18 00:11 – Updated: 2026-08-01 03:55Title
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
Summary
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions
* The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
Severity
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-25 00:00 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ptc.com/en/support/article/CS473270 | vendor-advisorymitigationpermissions-required |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Windchill PDMLink |
Affected:
0 , ≤ 11.0 M030
(semver)
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.2.0 Affected: 12.1.2.0 Affected: 13.0.2.0 Affected: 13.1.0.0 Affected: 13.1.1.0 Affected: 13.1.2.0 Affected: 13.1.3.0 |
|
| PTC | FlexPLM |
Affected:
0 , ≤ 11.0 M030
(semver)
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.0.0 Affected: 12.0.2.0 Affected: 12.1.2.0 Affected: 12.1.3.0 Affected: 13.0.2.0 Affected: 13.0.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12569",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-25T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-06-25",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T03:55:29.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Windchill PDMLink",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "11.0 M030",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.1.0.0"
},
{
"status": "affected",
"version": "13.1.1.0"
},
{
"status": "affected",
"version": "13.1.2.0"
},
{
"status": "affected",
"version": "13.1.3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FlexPLM",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "11.0 M030",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.0.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "12.1.3.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.0.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\u0026nbsp;\u003cdiv\u003e\u003cul\u003e\u003cli\u003eThis advisory also applies to all CPS versions\u003c/li\u003e\u003cli\u003eThe identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e"
}
],
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\u00a0 * This advisory also applies to all CPS versions\n * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030"
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
},
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of untrusted data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T00:11:35.241Z",
"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"shortName": "PTC"
},
"references": [
{
"tags": [
"vendor-advisory",
"mitigation",
"permissions-required"
],
"url": "https://www.ptc.com/en/support/article/CS473270"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Remote Code Execution (RCE) vulnerability in Windchill PDMlink",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"assignerShortName": "PTC",
"cveId": "CVE-2026-12569",
"datePublished": "2026-06-18T00:11:35.241Z",
"dateReserved": "2026-06-18T00:02:58.904Z",
"dateUpdated": "2026-08-01T03:55:29.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4681 (GCVE-0-2026-4681)
Vulnerability from cvelistv5 – Published: 2026-03-23 21:48 – Updated: 2026-03-24 14:49
VLAI
EPSS
VEX
Title
Critical Remote Code Execution vulnerability reported in Windchill
Summary
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-24 14:48 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ptc.com/en/about/trust-center/advisor… | vendor-advisorymitigation |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Windchill PDMLink |
Affected:
11.0 M030
(semver)
Affected: 11.1 M020 (semver) Affected: 11.2.1.0 (semver) Affected: 12.0.2.0 (semver) Affected: 12.1.2.0 (semver) Affected: 13.0.2.0 (semver) Affected: 13.1.0.0 Affected: 13.1.1.0 Affected: 13.1.2.0 Affected: 13.1.3.0 |
|
| PTC | FlexPLM |
Affected:
11.0 M030
Affected: 11.1 M020 Affected: 11.2.1.0 Affected: 12.0.0.0 Affected: 12.0.2.0 Affected: 12.0.3.0 Affected: 12.1.2.0 Affected: 12.1.3.0 Affected: 13.0.2.0 Affected: 13.0.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4681",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T14:48:53.854433Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T14:49:43.425Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Windchill PDMLink",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.1 M020",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.2.1.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "12.0.2.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "12.1.2.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "13.0.2.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "13.1.0.0"
},
{
"status": "affected",
"version": "13.1.1.0"
},
{
"status": "affected",
"version": "13.1.2.0"
},
{
"status": "affected",
"version": "13.1.3.0"
}
]
},
{
"defaultStatus": "unknown",
"product": "FlexPLM",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "11.0 M030"
},
{
"status": "affected",
"version": "11.1 M020"
},
{
"status": "affected",
"version": "11.2.1.0"
},
{
"status": "affected",
"version": "12.0.0.0"
},
{
"status": "affected",
"version": "12.0.2.0"
},
{
"status": "affected",
"version": "12.0.3.0"
},
{
"status": "affected",
"version": "12.1.2.0"
},
{
"status": "affected",
"version": "12.1.3.0"
},
{
"status": "affected",
"version": "13.0.2.0"
},
{
"status": "affected",
"version": "13.0.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cspan\u003eA critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eThis issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0.\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\n\nThis issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:M/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T21:48:05.652Z",
"orgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"shortName": "PTC"
},
"references": [
{
"tags": [
"vendor-advisory",
"mitigation"
],
"url": "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability?srsltid=AfmBOop3e7Nthx5-BsrjKdpZi50wL6l6Bt21Fz0gUub2cIPgdPGV5bNl"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Critical Remote Code Execution vulnerability reported in Windchill",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "0b655efc-079c-4cb9-9e8d-164871239f4e",
"assignerShortName": "PTC",
"cveId": "CVE-2026-4681",
"datePublished": "2026-03-23T21:48:05.652Z",
"dateReserved": "2026-03-23T21:42:24.158Z",
"dateUpdated": "2026-03-24T14:49:43.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-40395 (GCVE-0-2024-40395)
Vulnerability from cvelistv5 – Published: 2024-08-27 00:00 – Updated: 2025-03-25 16:20
VLAI
EPSS
VEX
Summary
An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-27 19:29 UTC
CWE
- n/a
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://pastebin.com/9dc4LYGA |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-40395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-27T19:29:22.699052Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T16:20:43.892Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T16:03:41.459Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://pastebin.com/9dc4LYGA"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-40395",
"datePublished": "2024-08-27T00:00:00.000Z",
"dateReserved": "2024-07-05T00:00:00.000Z",
"dateUpdated": "2025-03-25T16:20:43.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6098 (GCVE-0-2024-6098)
Vulnerability from cvelistv5 – Published: 2024-08-16 14:57 – Updated: 2024-08-19 17:32
VLAI
EPSS
VEX
Title
PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling
Summary
When performing an online tag generation to devices which communicate
using the ControlLogix protocol, a machine-in-the-middle, or a device
that is not configured correctly, could deliver a response leading to
unrestricted or unregulated resource allocation. This could cause a
denial-of-service condition and crash the Kepware application. By
default, these functions are turned off, yet they remain accessible for
users who recognize and require their advantages.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-19 17:32 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Kepware ThingWorx Kepware Server |
Affected:
V6
|
|
| PTC | Kepware KEPServerEX |
Affected:
V6
|
|
| Software Toolbox | TOP Server |
Affected:
V6
|
|
| GE | IGS |
Affected:
V7.6x
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-19T17:32:29.303502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-19T17:32:48.721Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kepware ThingWorx Kepware Server",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "V6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Kepware KEPServerEX",
"vendor": "PTC",
"versions": [
{
"status": "affected",
"version": "V6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TOP Server",
"vendor": "Software Toolbox",
"versions": [
{
"status": "affected",
"version": "V6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IGS",
"vendor": "GE",
"versions": [
{
"status": "affected",
"version": "V7.6x"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sharon Brizinov and Vera Mens of Claroty Research - Team82 reported this vulnerability to PTC."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When performing an online tag generation to devices which communicate \nusing the ControlLogix protocol, a machine-in-the-middle, or a device \nthat is not configured correctly, could deliver a response leading to \nunrestricted or unregulated resource allocation. This could cause a \ndenial-of-service condition and crash the Kepware application. By \ndefault, these functions are turned off, yet they remain accessible for \nusers who recognize and require their advantages."
}
],
"value": "When performing an online tag generation to devices which communicate \nusing the ControlLogix protocol, a machine-in-the-middle, or a device \nthat is not configured correctly, could deliver a response leading to \nunrestricted or unregulated resource allocation. This could cause a \ndenial-of-service condition and crash the Kepware application. By \ndefault, these functions are turned off, yet they remain accessible for \nusers who recognize and require their advantages."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-16T14:57:51.023Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-11"
},
{
"url": "https://www.ptc.com/en/support/article/CS423892"
}
],
"source": {
"advisory": "ICSA-24-228-11",
"discovery": "EXTERNAL"
},
"title": "PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PTC recommends users take a defense-in-depth stance with regards to \ntheir manufacturing networks ensuring proper access control is \nmaintained. Additionally, proper adherence to the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ptc.com/support/-/media/support/refdocs/ThingWorx_Kepware_Server/6,-d-,16/secure_deployment_guide_tks.pdf?sc_lang=en\u0026amp;source=search\"\u003eKepware Secure Deployment Guide\u003c/a\u003e\u003cp\u003e will minimize this threat through accurate configuration and use of the product.\u003c/p\u003e\n\u003cp\u003ePlease refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ptc.com/en/support/article/CS423892\"\u003ethis article (login required)\u003c/a\u003e\u003c/p\u003e\u003cp\u003e for specific information on how this risk may be mitigated in your environment.\u003c/p\u003e\n\u003cp\u003eIf additional questions remain, contact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/apps/case_logger_viewer/cs/auth/ssl/log?\"\u003ePTC Technical Support.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "PTC recommends users take a defense-in-depth stance with regards to \ntheir manufacturing networks ensuring proper access control is \nmaintained. Additionally, proper adherence to the Kepware Secure Deployment Guide https://www.ptc.com/support/-/media/support/refdocs/ThingWorx_Kepware_Server/6,-d-,16/secure_deployment_guide_tks.pdf will minimize this threat through accurate configuration and use of the product.\n\n\nPlease refer to this article (login required) https://www.ptc.com/en/support/article/CS423892 \n\n for specific information on how this risk may be mitigated in your environment.\n\n\nIf additional questions remain, contact PTC Technical Support. https://support.ptc.com/apps/case_logger_viewer/cs/auth/ssl/log"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-6098",
"datePublished": "2024-08-16T14:57:51.023Z",
"dateReserved": "2024-06-17T21:40:20.832Z",
"dateUpdated": "2024-08-19T17:32:48.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6071 (GCVE-0-2024-6071)
Vulnerability from cvelistv5 – Published: 2024-06-27 23:05 – Updated: 2024-08-01 21:25
VLAI
EPSS
VEX
Title
PTC Creo Elements/Direct License Server Missing Authorization
Summary
PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-28 15:22 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Creo Elements/Direct License |
Affected:
0 , ≤ 20.7.0.0
(custom)
|
|
| creo | creo_elements\/direct_license |
Affected:
0 , ≤ 20.7.0.0
(custom)
cpe:2.3:a:creo:creo_elements\/direct_license:0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:creo:creo_elements\\/direct_license:0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "creo_elements\\/direct_license",
"vendor": "creo",
"versions": [
{
"lessThanOrEqual": "20.7.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6071",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-28T15:22:36.234542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-28T15:26:22.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:25:03.240Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-177-02"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.ptc.com/en/support/article/CS417607"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Creo Elements/Direct License",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "20.7.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thomas Riedmaier of Siemens Energy reported this vulnerability to PTC."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-27T23:05:03.183Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-177-02"
},
{
"url": "https://www.ptc.com/en/support/article/CS417607"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003ePTC recommends that users upgrade to Creo Elements/Direct License Server 20.7.0.1 or higher version:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CDR\"\u003eCreo Elements/Direct Drafting\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CMM\"\u003eCreo Elements/Direct Model/Drawing Mgr\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CML\"\u003eCreo Elements/Direct Modeling\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CWM\"\u003eCreo Elements/Direct WorkManager\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eIf additional questions remain, please contact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/apps/case_logger_viewer/cs/auth/ssl/log?\"\u003ePTC Technical Support.\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor more information, see \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ptc.com/en/support/article/CS417607\"\u003ePTC\u0027s CS article\u003c/a\u003e.\u003c/p\u003e\n\n"
}
],
"value": "PTC recommends that users upgrade to Creo Elements/Direct License Server 20.7.0.1 or higher version:\n\n * Creo Elements/Direct Drafting https://support.ptc.com/appserver/auth/it/esd/product.jsp \n * Creo Elements/Direct Model/Drawing Mgr https://support.ptc.com/appserver/auth/it/esd/product.jsp \n * Creo Elements/Direct Modeling https://support.ptc.com/appserver/auth/it/esd/product.jsp \n * Creo Elements/Direct WorkManager https://support.ptc.com/appserver/auth/it/esd/product.jsp \n\n\nIf additional questions remain, please contact PTC Technical Support. https://support.ptc.com/apps/case_logger_viewer/cs/auth/ssl/log \n\nFor more information, see PTC\u0027s CS article https://www.ptc.com/en/support/article/CS417607 ."
}
],
"source": {
"advisory": "ICSA-24-177-02",
"discovery": "EXTERNAL"
},
"title": "PTC Creo Elements/Direct License Server Missing Authorization",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-6071",
"datePublished": "2024-06-27T23:05:03.183Z",
"dateReserved": "2024-06-17T15:17:28.397Z",
"dateUpdated": "2024-08-01T21:25:03.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-3951 (GCVE-0-2024-3951)
Vulnerability from cvelistv5 – Published: 2024-05-08 14:38 – Updated: 2024-08-01 20:26
VLAI
EPSS
VEX
Title
Cross-site Scripting in PTC Codebeamer
Summary
PTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-08 17:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Codebeamer |
Affected:
0 , ≤ 22.10 SP9
(custom)
Affected: 0 , ≤ 2.0.0.3 (custom) Affected: 2.1.0.0 |
|
| ptc | codebeamer |
Affected:
0
cpe:2.3:a:ptc:codebeamer:0:*:*:*:*:*:*:* |
|
| ptc | codebeamer |
Affected:
2.1.0.0
cpe:2.3:a:ptc:codebeamer:2.1.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ptc:codebeamer:0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "codebeamer",
"vendor": "ptc",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"cpes": [
"cpe:2.3:a:ptc:codebeamer:2.1.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "codebeamer",
"vendor": "ptc",
"versions": [
{
"status": "affected",
"version": "2.1.0.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-3951",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-08T17:26:49.961585Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:33:21.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:26:57.164Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Codebeamer",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "22.10 SP9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.0.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2.1.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marek Holka (ETAS) reported this vulnerability to PTC."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003ePTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code.\u003c/p\u003e\n\n"
}
],
"value": "\nPTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-08T14:38:31.791Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003ePTC released the following resolutions:\u003c/p\u003e\u003cul\u003e\u003cli\u003eCodebeamer: Update to version \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CBM\"\u003e22.10 SP10\u003c/a\u003e\u0026nbsp;or later\u003c/li\u003e\u003cli\u003eCodebeamer: Update to version \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CBM\"\u003e2.0.0.4\u003c/a\u003e\u0026nbsp;or later\u003c/li\u003e\u003cli\u003eCodebeamer: Update to version \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.ptc.com/appserver/auth/it/esd/product.jsp?prodFamily=CBM\"\u003e2.1.0.1\u003c/a\u003e\u0026nbsp;or later\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor more information, see PTC\u0027s \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ptc.com/en/support/article/CS416309\"\u003ecustomer support article\u003c/a\u003e.\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "\nPTC released the following resolutions:\n\n * Codebeamer: Update to version 22.10 SP10 https://support.ptc.com/appserver/auth/it/esd/product.jsp \u00a0or later\n * Codebeamer: Update to version 2.0.0.4 https://support.ptc.com/appserver/auth/it/esd/product.jsp \u00a0or later\n * Codebeamer: Update to version 2.1.0.1 https://support.ptc.com/appserver/auth/it/esd/product.jsp \u00a0or later\n\nFor more information, see PTC\u0027s customer support article https://www.ptc.com/en/support/article/CS416309 .\n\n"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site Scripting in PTC Codebeamer",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-3951",
"datePublished": "2024-05-08T14:38:31.791Z",
"dateReserved": "2024-04-18T14:33:58.780Z",
"dateUpdated": "2024-08-01T20:26:57.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29447 (GCVE-0-2023-29447)
Vulnerability from cvelistv5 – Published: 2024-01-10 20:24 – Updated: 2025-06-17 20:59
VLAI
EPSS
VEX
Title
Insufficiently Protected Credentials in PTC's Kepware KEPServerEX
Summary
An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-01-11 02:38 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
| https://www.ptc.com/en/support/article/cs399528 | vendor-advisory |
| https://www.dragos.com/advisory/ptcs-kepserverex-… |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Kepware KEPServerEX |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Kepware Server |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Industrial Connectivity |
Affected:
8.0 , ≤ 8.5
(0)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:07:46.417Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-11T02:38:36.071314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-17T20:59:11.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Kepware KEPServerEX",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Kepware Server",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Industrial Connectivity",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "8.0",
"versionType": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Sam Hanson of Dragos"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication."
}
],
"value": "An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Man in the Middle Attack"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T15:45:53.226Z",
"orgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"shortName": "Dragos"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficiently Protected Credentials in PTC\u0027s Kepware KEPServerEX",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"assignerShortName": "Dragos",
"cveId": "CVE-2023-29447",
"datePublished": "2024-01-10T20:24:52.983Z",
"dateReserved": "2023-04-06T17:45:40.441Z",
"dateUpdated": "2025-06-17T20:59:11.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29446 (GCVE-0-2023-29446)
Vulnerability from cvelistv5 – Published: 2024-01-10 20:21 – Updated: 2024-11-14 17:23
VLAI
EPSS
VEX
Title
Improper Input Validation in PTC's Kepware KEPServerEX
Summary
An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-14 17:23 UTC
CWE
- CWE-40 - Path Traversal: '\\UNC\share\name\' (Windows UNC Share)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
| https://www.ptc.com/en/support/article/cs399528 | vendor-advisory |
| https://www.dragos.com/advisory/ptcs-kepserverex-… |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Kepware KEPServerEX |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Kepware Server |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Industrial Connectivity |
Affected:
8.0 , ≤ 8.5
(0)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:07:46.304Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29446",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T17:23:25.379414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T17:23:37.514Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Kepware KEPServerEX",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Kepware Server",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Industrial Connectivity",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "8.0",
"versionType": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Sam Hanson of Dragos"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.\u0026nbsp;"
}
],
"value": "An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline."
}
],
"impacts": [
{
"capecId": "CAPEC-644",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-644 Use of Captured Hashes (Pass The Hash)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-40",
"description": "CWE-40: Path Traversal: \u0027\\\\UNC\\share\\name\\\u0027 (Windows UNC Share)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-08T15:13:16.725Z",
"orgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"shortName": "Dragos"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Input Validation in PTC\u0027s Kepware KEPServerEX",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"assignerShortName": "Dragos",
"cveId": "CVE-2023-29446",
"datePublished": "2024-01-10T20:21:51.434Z",
"dateReserved": "2023-04-06T17:45:40.441Z",
"dateUpdated": "2024-11-14T17:23:37.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29445 (GCVE-0-2023-29445)
Vulnerability from cvelistv5 – Published: 2024-01-10 20:17 – Updated: 2025-06-17 20:59
VLAI
EPSS
VEX
Title
Uncontrolled Search Path Element in PTC's Kepware KEPServerEX
Summary
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-01-11 20:16 UTC
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
| https://www.ptc.com/en/support/article/cs399528 | vendor-advisory |
| https://www.dragos.com/advisory/ptcs-kepserverex-… |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Kepware KEPServerEX |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Kepware Server |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Industrial Connectivity |
Affected:
8.0 , ≤ 8.5
(0)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:07:46.126Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29445",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-11T20:16:37.750500Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-17T20:59:11.408Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Kepware KEPServerEX",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Kepware Server",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Industrial Connectivity",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "8.0",
"versionType": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Sam Hanson of Dragos"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM."
}
],
"value": "An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-10T20:17:12.837Z",
"orgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"shortName": "Dragos"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
},
{
"url": "https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Uncontrolled Search Path Element in PTC\u0027s Kepware KEPServerEX",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"assignerShortName": "Dragos",
"cveId": "CVE-2023-29445",
"datePublished": "2024-01-10T20:17:12.837Z",
"dateReserved": "2023-04-06T17:45:40.441Z",
"dateUpdated": "2025-06-17T20:59:11.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29444 (GCVE-0-2023-29444)
Vulnerability from cvelistv5 – Published: 2024-01-10 17:06 – Updated: 2025-05-14 20:14
VLAI
EPSS
VEX
Title
Uncontrolled Search Path Element in PTC's Kepware KEPServerEX
Summary
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-14 20:14 UTC
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
| https://www.ptc.com/en/support/article/cs399528 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTC | Kepware KEPServerEX |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Kepware Server |
Affected:
0 , ≤ 6.14.263.0
(0)
|
|
| PTC | ThingWorx Industrial Connectivity |
Affected:
8.0 , ≤ 8.5
(0)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:07:46.269Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29444",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-14T20:14:08.179087Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-14T20:14:19.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Kepware KEPServerEX",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Kepware Server",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "6.14.263.0",
"status": "affected",
"version": "0",
"versionType": "0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ThingWorx Industrial Connectivity",
"vendor": "PTC",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "8.0",
"versionType": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Sam Hanson of Dragos"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution."
}
],
"value": "An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-10T17:06:35.965Z",
"orgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"shortName": "Dragos"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ptc.com/en/support/article/cs399528"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Uncontrolled Search Path Element in PTC\u0027s Kepware KEPServerEX",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
"assignerShortName": "Dragos",
"cveId": "CVE-2023-29444",
"datePublished": "2024-01-10T17:06:35.965Z",
"dateReserved": "2023-04-06T17:45:40.441Z",
"dateUpdated": "2025-05-14T20:14:19.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-202101-0382
Vulnerability from variot - Updated: 2023-12-18 13:07KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server all 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data. PTC The following vulnerabilities exist in multiple products provided by the company. ‥ * Stack-based buffer overflow (CWE-121) - CVE-2020-27265 ‥ * Heap-based buffer overflow (CWE-122) - CVE-2020-27263 ‥ * Use of freed memory (use-after-free) (CWE-416) - CVE-2020-27267 ‥ * Inappropriate default permissions (CWE-276) - CVE-2020-13535The expected impact depends on each vulnerability, but it may be affected as follows. Kepware Kepserverex is an application software of American Kepware Company that can communicate with a variety of industrial equipment. The software supports more than 150 communication protocols and supports reliable real-time data for enterprises through a single platform. A security vulnerability exists in PTC Kepware KEPServerEX that could allow a remote attacker to cause the application to crash
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202101-0382",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "thingworx kepware server",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.9"
},
{
"model": "kepware kepserverex",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.9"
},
{
"model": "thingworx kepware server",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.8"
},
{
"model": "kepserver enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.9.572.0"
},
{
"model": "industrial gateway server",
"scope": "eq",
"trust": 1.0,
"vendor": "ge",
"version": "7.68.804"
},
{
"model": "kepware kepserverex",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.0"
},
{
"model": "opc-aggregator",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": null
},
{
"model": "kepserver enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.6.504.0"
},
{
"model": "top server",
"scope": "gte",
"trust": 1.0,
"vendor": "softwaretoolbox",
"version": "6.0"
},
{
"model": "industrial gateway server",
"scope": "eq",
"trust": 1.0,
"vendor": "ge",
"version": "7.66"
},
{
"model": "top server",
"scope": "lte",
"trust": 1.0,
"vendor": "softwaretoolbox",
"version": "6.9"
},
{
"model": "thingworx industrial connectivity",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": null
},
{
"model": "industrial gateway server",
"scope": "eq",
"trust": 0.8,
"vendor": "ge digital",
"version": "version 7.68.804 \u304a\u3088\u3073 version 7.66"
},
{
"model": "kepserverex",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "version 6.0 \u304b\u3089 version 6.9"
},
{
"model": "kepware linkmaster",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "version 3.0.94.0"
},
{
"model": "opc-aggregator",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "\u3059\u3079\u3066"
},
{
"model": "thingworx industrial connectivity",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "\u3059\u3079\u3066"
},
{
"model": "thingworx kepware server",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "version 6.8 \u304a\u3088\u3073 version 6.9"
},
{
"model": "kepserver enterprise",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "top server",
"scope": "eq",
"trust": 0.8,
"vendor": "toolbox",
"version": "6\u7cfb\u306e\u3059\u3079\u3066"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27267"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ge:industrial_gateway_server:7.66:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ge:industrial_gateway_server:7.68.804:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:kepware_kepserverex:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:kepware_kepserverex:6.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:opc-aggregator:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_industrial_connectivity:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_kepware_server:6.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_kepware_server:6.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:kepserver_enterprise:6.6.504.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:kepserver_enterprise:6.9.572.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:softwaretoolbox:top_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.9",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-27267"
}
]
},
"cve": "CVE-2020-27267",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-370757",
"impactScore": 4.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 9.1,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 9.3,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "IPA",
"id": "JVNDB-2020-010092",
"trust": 2.4,
"value": "Critical"
},
{
"author": "NVD",
"id": "CVE-2020-27267",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "IPA",
"id": "JVNDB-2020-010092",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202012-1299",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-370757",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370757"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27267"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1299"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server all 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data. PTC The following vulnerabilities exist in multiple products provided by the company. \u2025 * Stack-based buffer overflow (CWE-121) - CVE-2020-27265 \u2025 * Heap-based buffer overflow (CWE-122) - CVE-2020-27263 \u2025 * Use of freed memory (use-after-free) (CWE-416) - CVE-2020-27267 \u2025 * Inappropriate default permissions (CWE-276) - CVE-2020-13535The expected impact depends on each vulnerability, but it may be affected as follows. Kepware Kepserverex is an application software of American Kepware Company that can communicate with a variety of industrial equipment. The software supports more than 150 communication protocols and supports reliable real-time data for enterprises through a single platform. A security vulnerability exists in PTC Kepware KEPServerEX that could allow a remote attacker to cause the application to crash",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-27267"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "VULHUB",
"id": "VHN-370757"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-27267",
"trust": 2.5
},
{
"db": "ICS CERT",
"id": "ICSA-20-352-02",
"trust": 2.5
},
{
"db": "JVN",
"id": "JVNVU98489812",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-20-352-03",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1299",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.4481",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-370757",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370757"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27267"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1299"
}
]
},
"id": "VAR-202101-0382",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-370757"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:07:19.736000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Customer Center",
"trust": 0.8,
"url": "https://digitalsupport.ge.com/communities/cc_login?starturl=%2fen_us%2fdownload%2figs-industrial-gateway-server-v7-xx"
},
{
"title": "GE Digital Product Security Advisory",
"trust": 0.8,
"url": "https://digitalsupport.ge.com/communities/servlet/filefield?returl=%2fcommunities%2fapex%2fknowledgedetail%3fid%3dka20h0000000dpqcaa%26lang%3den_us%26type%3darticle__kav\u0026entityid=ka20h00000013uhaaq\u0026field=file_1__body__s"
},
{
"title": "My Kepware Customer Self-Service Portal",
"trust": 0.8,
"url": "https://my.kepware.com/s/login/?ec=302\u0026starturl=%2fs%2f"
},
{
"title": "PTC eSupport",
"trust": 0.8,
"url": "https://support.ptc.com/appserver/common/login/ssl/login.jsp?dest=%2fappserver%2fcs%2fportal%2f\u0026msg=1"
},
{
"title": "Kepserver Enterprise",
"trust": 0.8,
"url": "https://rockwellautomation.custhelp.com/app/products/detail/categoryrecordid/rn_product_611/p/611/~/kepserver-enterprise"
},
{
"title": "CISA Advisory ICSA-20-352-02 - TOP Server OPC UA Server Interface Vulnerability",
"trust": 0.8,
"url": "https://support.softwaretoolbox.com/app/answers/detail/a_id/3924"
},
{
"title": "Kepware KEPServerEX Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=137769"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1299"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.1
},
{
"problemtype": "CWE-121",
"trust": 0.8
},
{
"problemtype": "CWE-122",
"trust": 0.8
},
{
"problemtype": "CWE-416",
"trust": 0.8
},
{
"problemtype": "CWE-276",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370757"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27267"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-352-02"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-13535"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-27263"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-27265"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-27267"
},
{
"trust": 0.8,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-352-03"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98489812"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.4481/"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-27267"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370757"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27267"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1299"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-370757"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27267"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1299"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-01-14T00:00:00",
"db": "VULHUB",
"id": "VHN-370757"
},
{
"date": "2020-12-21T09:01:13",
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"date": "2021-01-14T00:15:13.510000",
"db": "NVD",
"id": "CVE-2020-27267"
},
{
"date": "2020-12-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202012-1299"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-01-21T00:00:00",
"db": "VULHUB",
"id": "VHN-370757"
},
{
"date": "2020-12-21T09:01:13",
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"date": "2021-01-21T16:16:31.057000",
"db": "NVD",
"id": "CVE-2020-27267"
},
{
"date": "2021-01-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202012-1299"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202012-1299"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural PTC Product vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202012-1299"
}
],
"trust": 0.6
}
}
VAR-202101-0380
Vulnerability from variot - Updated: 2023-12-18 13:07KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions are vulnerable to a stack-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and remotely execute code. PTC The following vulnerabilities exist in multiple products provided by the company. ‥ * Stack-based buffer overflow (CWE-121) - CVE-2020-27265 ‥ * Heap-based buffer overflow (CWE-122) - CVE-2020-27263 ‥ * Use of freed memory (use-after-free) (CWE-416) - CVE-2020-27267 ‥ * Inappropriate default permissions (CWE-276) - CVE-2020-13535The expected impact depends on each vulnerability, but it may be affected as follows. Kepware Kepserverex is an application software of American Kepware Company that can communicate with a variety of industrial equipment. The software supports more than 150 communication protocols and supports reliable real-time data for enterprises through a single platform
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202101-0380",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "thingworx kepware server",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.9"
},
{
"model": "kepware kepserverex",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.9"
},
{
"model": "thingworx kepware server",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.8"
},
{
"model": "kepserver enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.9.572.0"
},
{
"model": "industrial gateway server",
"scope": "eq",
"trust": 1.0,
"vendor": "ge",
"version": "7.68.804"
},
{
"model": "kepware kepserverex",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.0"
},
{
"model": "opc-aggregator",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": null
},
{
"model": "kepserver enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.6.504.0"
},
{
"model": "top server",
"scope": "gte",
"trust": 1.0,
"vendor": "softwaretoolbox",
"version": "6.0"
},
{
"model": "industrial gateway server",
"scope": "eq",
"trust": 1.0,
"vendor": "ge",
"version": "7.66"
},
{
"model": "top server",
"scope": "lte",
"trust": 1.0,
"vendor": "softwaretoolbox",
"version": "6.9"
},
{
"model": "thingworx industrial connectivity",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": null
},
{
"model": "industrial gateway server",
"scope": "eq",
"trust": 0.8,
"vendor": "ge digital",
"version": "version 7.68.804 \u304a\u3088\u3073 version 7.66"
},
{
"model": "kepserverex",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "version 6.0 \u304b\u3089 version 6.9"
},
{
"model": "kepware linkmaster",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "version 3.0.94.0"
},
{
"model": "opc-aggregator",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "\u3059\u3079\u3066"
},
{
"model": "thingworx industrial connectivity",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "\u3059\u3079\u3066"
},
{
"model": "thingworx kepware server",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "version 6.8 \u304a\u3088\u3073 version 6.9"
},
{
"model": "kepserver enterprise",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "top server",
"scope": "eq",
"trust": 0.8,
"vendor": "toolbox",
"version": "6\u7cfb\u306e\u3059\u3079\u3066"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27265"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ge:industrial_gateway_server:7.66:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ge:industrial_gateway_server:7.68.804:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:kepware_kepserverex:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:kepware_kepserverex:6.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:opc-aggregator:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_industrial_connectivity:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_kepware_server:6.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_kepware_server:6.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:kepserver_enterprise:6.6.504.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:kepserver_enterprise:6.9.572.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:softwaretoolbox:top_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.9",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-27265"
}
]
},
"cve": "CVE-2020-27265",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-370753",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 9.1,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 9.3,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "IPA",
"id": "JVNDB-2020-010092",
"trust": 2.4,
"value": "Critical"
},
{
"author": "NVD",
"id": "CVE-2020-27265",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "IPA",
"id": "JVNDB-2020-010092",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202012-1305",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-370753",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370753"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27265"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1305"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions are vulnerable to a stack-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and remotely execute code. PTC The following vulnerabilities exist in multiple products provided by the company. \u2025 * Stack-based buffer overflow (CWE-121) - CVE-2020-27265 \u2025 * Heap-based buffer overflow (CWE-122) - CVE-2020-27263 \u2025 * Use of freed memory (use-after-free) (CWE-416) - CVE-2020-27267 \u2025 * Inappropriate default permissions (CWE-276) - CVE-2020-13535The expected impact depends on each vulnerability, but it may be affected as follows. Kepware Kepserverex is an application software of American Kepware Company that can communicate with a variety of industrial equipment. The software supports more than 150 communication protocols and supports reliable real-time data for enterprises through a single platform",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-27265"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "VULHUB",
"id": "VHN-370753"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "ICS CERT",
"id": "ICSA-20-352-02",
"trust": 2.5
},
{
"db": "NVD",
"id": "CVE-2020-27265",
"trust": 2.5
},
{
"db": "JVN",
"id": "JVNVU98489812",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-20-352-03",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1305",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.4481",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-370753",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370753"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27265"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1305"
}
]
},
"id": "VAR-202101-0380",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-370753"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:07:19.712000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Customer Center",
"trust": 0.8,
"url": "https://digitalsupport.ge.com/communities/cc_login?starturl=%2fen_us%2fdownload%2figs-industrial-gateway-server-v7-xx"
},
{
"title": "GE Digital Product Security Advisory",
"trust": 0.8,
"url": "https://digitalsupport.ge.com/communities/servlet/filefield?returl=%2fcommunities%2fapex%2fknowledgedetail%3fid%3dka20h0000000dpqcaa%26lang%3den_us%26type%3darticle__kav\u0026entityid=ka20h00000013uhaaq\u0026field=file_1__body__s"
},
{
"title": "My Kepware Customer Self-Service Portal",
"trust": 0.8,
"url": "https://my.kepware.com/s/login/?ec=302\u0026starturl=%2fs%2f"
},
{
"title": "PTC eSupport",
"trust": 0.8,
"url": "https://support.ptc.com/appserver/common/login/ssl/login.jsp?dest=%2fappserver%2fcs%2fportal%2f\u0026msg=1"
},
{
"title": "Kepserver Enterprise",
"trust": 0.8,
"url": "https://rockwellautomation.custhelp.com/app/products/detail/categoryrecordid/rn_product_611/p/611/~/kepserver-enterprise"
},
{
"title": "CISA Advisory ICSA-20-352-02 - TOP Server OPC UA Server Interface Vulnerability",
"trust": 0.8,
"url": "https://support.softwaretoolbox.com/app/answers/detail/a_id/3924"
},
{
"title": "Multiple Kepware Product security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=137773"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1305"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.1
},
{
"problemtype": "CWE-121",
"trust": 0.8
},
{
"problemtype": "CWE-122",
"trust": 0.8
},
{
"problemtype": "CWE-416",
"trust": 0.8
},
{
"problemtype": "CWE-276",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370753"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27265"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-352-02"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-13535"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-27263"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-27265"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-27267"
},
{
"trust": 0.8,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-352-03"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98489812"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.4481/"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-27265"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370753"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27265"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1305"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-370753"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27265"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1305"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-01-14T00:00:00",
"db": "VULHUB",
"id": "VHN-370753"
},
{
"date": "2020-12-21T09:01:13",
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"date": "2021-01-14T00:15:13.417000",
"db": "NVD",
"id": "CVE-2020-27265"
},
{
"date": "2020-12-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202012-1305"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-01-21T00:00:00",
"db": "VULHUB",
"id": "VHN-370753"
},
{
"date": "2020-12-21T09:01:13",
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"date": "2021-01-21T16:20:52.077000",
"db": "NVD",
"id": "CVE-2020-27265"
},
{
"date": "2021-01-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202012-1305"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202012-1305"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural PTC Product vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202012-1305"
}
],
"trust": 0.6
}
}
VAR-202101-0378
Vulnerability from variot - Updated: 2023-12-18 13:07KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data. PTC The following vulnerabilities exist in multiple products provided by the company. ‥ * Stack-based buffer overflow (CWE-121) - CVE-2020-27265 ‥ * Heap-based buffer overflow (CWE-122) - CVE-2020-27263 ‥ * Use of freed memory (use-after-free) (CWE-416) - CVE-2020-27267 ‥ * Inappropriate default permissions (CWE-276) - CVE-2020-13535The expected impact depends on each vulnerability, but it may be affected as follows. Kepware Kepserverex is an application software of American Kepware Company that can communicate with a variety of industrial equipment. The software supports more than 150 communication protocols and supports reliable real-time data for enterprises through a single platform
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202101-0378",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "thingworx kepware server",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.9"
},
{
"model": "kepware kepserverex",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.9"
},
{
"model": "thingworx kepware server",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.8"
},
{
"model": "kepserver enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.9.572.0"
},
{
"model": "industrial gateway server",
"scope": "eq",
"trust": 1.0,
"vendor": "ge",
"version": "7.68.804"
},
{
"model": "kepware kepserverex",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "6.0"
},
{
"model": "opc-aggregator",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": null
},
{
"model": "kepserver enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.6.504.0"
},
{
"model": "top server",
"scope": "gte",
"trust": 1.0,
"vendor": "softwaretoolbox",
"version": "6.0"
},
{
"model": "industrial gateway server",
"scope": "eq",
"trust": 1.0,
"vendor": "ge",
"version": "7.66"
},
{
"model": "top server",
"scope": "lte",
"trust": 1.0,
"vendor": "softwaretoolbox",
"version": "6.9"
},
{
"model": "thingworx industrial connectivity",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": null
},
{
"model": "industrial gateway server",
"scope": "eq",
"trust": 0.8,
"vendor": "ge digital",
"version": "version 7.68.804 \u304a\u3088\u3073 version 7.66"
},
{
"model": "kepserverex",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "version 6.0 \u304b\u3089 version 6.9"
},
{
"model": "kepware linkmaster",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "version 3.0.94.0"
},
{
"model": "opc-aggregator",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "\u3059\u3079\u3066"
},
{
"model": "thingworx industrial connectivity",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "\u3059\u3079\u3066"
},
{
"model": "thingworx kepware server",
"scope": "eq",
"trust": 0.8,
"vendor": "ptc",
"version": "version 6.8 \u304a\u3088\u3073 version 6.9"
},
{
"model": "kepserver enterprise",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "top server",
"scope": "eq",
"trust": 0.8,
"vendor": "toolbox",
"version": "6\u7cfb\u306e\u3059\u3079\u3066"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27263"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ge:industrial_gateway_server:7.66:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ge:industrial_gateway_server:7.68.804:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:kepware_kepserverex:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:kepware_kepserverex:6.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:opc-aggregator:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_industrial_connectivity:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_kepware_server:6.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_kepware_server:6.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:kepserver_enterprise:6.6.504.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:kepserver_enterprise:6.9.572.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:softwaretoolbox:top_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.9",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-27263"
}
]
},
"cve": "CVE-2020-27263",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-370749",
"impactScore": 4.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 9.1,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "IPA score",
"availabilityImpact": "High",
"baseScore": 9.3,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-010092",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "IPA",
"id": "JVNDB-2020-010092",
"trust": 2.4,
"value": "Critical"
},
{
"author": "NVD",
"id": "CVE-2020-27263",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "IPA",
"id": "JVNDB-2020-010092",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202012-1301",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-370749",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370749"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27263"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1301"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data. PTC The following vulnerabilities exist in multiple products provided by the company. \u2025 * Stack-based buffer overflow (CWE-121) - CVE-2020-27265 \u2025 * Heap-based buffer overflow (CWE-122) - CVE-2020-27263 \u2025 * Use of freed memory (use-after-free) (CWE-416) - CVE-2020-27267 \u2025 * Inappropriate default permissions (CWE-276) - CVE-2020-13535The expected impact depends on each vulnerability, but it may be affected as follows. Kepware Kepserverex is an application software of American Kepware Company that can communicate with a variety of industrial equipment. The software supports more than 150 communication protocols and supports reliable real-time data for enterprises through a single platform",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-27263"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "VULHUB",
"id": "VHN-370749"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "ICS CERT",
"id": "ICSA-20-352-02",
"trust": 2.5
},
{
"db": "NVD",
"id": "CVE-2020-27263",
"trust": 2.5
},
{
"db": "JVN",
"id": "JVNVU98489812",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-20-352-03",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1301",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.4481",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-370749",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370749"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27263"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1301"
}
]
},
"id": "VAR-202101-0378",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-370749"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:07:19.688000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Customer Center",
"trust": 0.8,
"url": "https://digitalsupport.ge.com/communities/cc_login?starturl=%2fen_us%2fdownload%2figs-industrial-gateway-server-v7-xx"
},
{
"title": "GE Digital Product Security Advisory",
"trust": 0.8,
"url": "https://digitalsupport.ge.com/communities/servlet/filefield?returl=%2fcommunities%2fapex%2fknowledgedetail%3fid%3dka20h0000000dpqcaa%26lang%3den_us%26type%3darticle__kav\u0026entityid=ka20h00000013uhaaq\u0026field=file_1__body__s"
},
{
"title": "My Kepware Customer Self-Service Portal",
"trust": 0.8,
"url": "https://my.kepware.com/s/login/?ec=302\u0026starturl=%2fs%2f"
},
{
"title": "PTC eSupport",
"trust": 0.8,
"url": "https://support.ptc.com/appserver/common/login/ssl/login.jsp?dest=%2fappserver%2fcs%2fportal%2f\u0026msg=1"
},
{
"title": "Kepserver Enterprise",
"trust": 0.8,
"url": "https://rockwellautomation.custhelp.com/app/products/detail/categoryrecordid/rn_product_611/p/611/~/kepserver-enterprise"
},
{
"title": "CISA Advisory ICSA-20-352-02 - TOP Server OPC UA Server Interface Vulnerability",
"trust": 0.8,
"url": "https://support.softwaretoolbox.com/app/answers/detail/a_id/3924"
},
{
"title": "PTC Kepware KEPServerEX Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=137540"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1301"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.1
},
{
"problemtype": "CWE-121",
"trust": 0.8
},
{
"problemtype": "CWE-122",
"trust": 0.8
},
{
"problemtype": "CWE-416",
"trust": 0.8
},
{
"problemtype": "CWE-276",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370749"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27263"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-352-02"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-13535"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-27263"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-27265"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-27267"
},
{
"trust": 0.8,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-352-03"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98489812"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.4481/"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-27263"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-370749"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27263"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1301"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-370749"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"db": "NVD",
"id": "CVE-2020-27263"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-1301"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-01-14T00:00:00",
"db": "VULHUB",
"id": "VHN-370749"
},
{
"date": "2020-12-21T09:01:13",
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"date": "2021-01-14T00:15:13.353000",
"db": "NVD",
"id": "CVE-2020-27263"
},
{
"date": "2020-12-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202012-1301"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-01-21T00:00:00",
"db": "VULHUB",
"id": "VHN-370749"
},
{
"date": "2020-12-21T09:01:13",
"db": "JVNDB",
"id": "JVNDB-2020-010092"
},
{
"date": "2021-01-21T16:10:30.217000",
"db": "NVD",
"id": "CVE-2020-27263"
},
{
"date": "2021-01-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202012-1301"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202012-1301"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural PTC Product vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010092"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202012-1301"
}
],
"trust": 0.6
}
}
VAR-202302-1840
Vulnerability from variot - Updated: 2023-12-18 12:54The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code. General Electric Company of digital industrial gateway server Products from other vendors contain integer overflow vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. PTC ThingWorx Edge is a complete end-to-end technology platform designed for the Industrial Internet of Things (IIoT) by PTC Corporation of the United States. ThingWorx Edge C-SDK version 2.2.12.1052 and earlier versions have an input validation error vulnerability, which is caused by integer overflow
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202302-1840",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "kepserver enterprise",
"scope": "lte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.12"
},
{
"model": "thingworx edge microserver",
"scope": "lte",
"trust": 1.0,
"vendor": "ptc",
"version": "5.4.10.0"
},
{
"model": "thingworx industrial connectivity",
"scope": "eq",
"trust": 1.0,
"vendor": "ptc",
"version": "*"
},
{
"model": "kepware server",
"scope": "lte",
"trust": 1.0,
"vendor": "ptc",
"version": "6.12"
},
{
"model": "thingworx edge c-sdk",
"scope": "lte",
"trust": 1.0,
"vendor": "ptc",
"version": "2.2.12.1052"
},
{
"model": "thingworx kepware edge",
"scope": "lte",
"trust": 1.0,
"vendor": "ptc",
"version": "1.5"
},
{
"model": "kepware serverex",
"scope": "lte",
"trust": 1.0,
"vendor": "ptc",
"version": "6.12"
},
{
"model": "thingworx .net-sdk",
"scope": "lte",
"trust": 1.0,
"vendor": "ptc",
"version": "5.8.4.971"
},
{
"model": "digital industrial gateway server",
"scope": "lte",
"trust": 1.0,
"vendor": "ge",
"version": "7.612"
},
{
"model": "thingworx edge microserver",
"scope": null,
"trust": 0.8,
"vendor": "ptc",
"version": null
},
{
"model": "thingworx kepware edge",
"scope": null,
"trust": 0.8,
"vendor": "ptc",
"version": null
},
{
"model": "digital industrial gateway server",
"scope": null,
"trust": 0.8,
"vendor": "general electric",
"version": null
},
{
"model": "thingworx .net-sdk",
"scope": null,
"trust": 0.8,
"vendor": "ptc",
"version": null
},
{
"model": "kepware serverex",
"scope": null,
"trust": 0.8,
"vendor": "ptc",
"version": null
},
{
"model": "kepserver enterprise",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "thingworx edge c-sdk",
"scope": null,
"trust": 0.8,
"vendor": "ptc",
"version": null
},
{
"model": "thingworx industrial connectivity",
"scope": null,
"trust": 0.8,
"vendor": "ptc",
"version": null
},
{
"model": "kepware server",
"scope": null,
"trust": 0.8,
"vendor": "ptc",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-004519"
},
{
"db": "NVD",
"id": "CVE-2023-0754"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:kepserver_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.12",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_kepware_edge:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_.net-sdk:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "5.8.4.971",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_edge_c-sdk:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.2.12.1052",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_edge_microserver:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "5.4.10.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:kepware_serverex:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.12",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ge:digital_industrial_gateway_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.612",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:kepware_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.12",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ptc:thingworx_industrial_connectivity:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2023-0754"
}
]
},
"cve": "CVE-2023-0754",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2023-0754",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2023-0754",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2023-0754",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "CNNVD",
"id": "CNNVD-202302-1949",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-004519"
},
{
"db": "NVD",
"id": "CVE-2023-0754"
},
{
"db": "NVD",
"id": "CVE-2023-0754"
},
{
"db": "CNNVD",
"id": "CNNVD-202302-1949"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "\nThe affected products are vulnerable to an integer\noverflow or wraparound, which could \u00a0allow an attacker to crash the server and remotely\nexecute arbitrary code. General Electric Company of digital industrial gateway server Products from other vendors contain integer overflow vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. PTC ThingWorx Edge is a complete end-to-end technology platform designed for the Industrial Internet of Things (IIoT) by PTC Corporation of the United States. \nThingWorx Edge C-SDK version 2.2.12.1052 and earlier versions have an input validation error vulnerability, which is caused by integer overflow",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-0754"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-004519"
},
{
"db": "CNNVD",
"id": "CNNVD-202302-1949"
},
{
"db": "VULHUB",
"id": "VHN-454620"
},
{
"db": "VULMON",
"id": "CVE-2023-0754"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-0754",
"trust": 3.4
},
{
"db": "ICS CERT",
"id": "ICSA-23-054-01",
"trust": 2.6
},
{
"db": "JVN",
"id": "JVNVU92776796",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2023-004519",
"trust": 0.8
},
{
"db": "AUSCERT",
"id": "ESB-2023.1203",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202302-1949",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-454620",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2023-0754",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-454620"
},
{
"db": "VULMON",
"id": "CVE-2023-0754"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-004519"
},
{
"db": "NVD",
"id": "CVE-2023-0754"
},
{
"db": "CNNVD",
"id": "CNNVD-202302-1949"
}
]
},
"id": "VAR-202302-1840",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-454620"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:54:30.303000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "PTC ThingWorx Edge Enter the fix for the verification error vulnerability",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=234213"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202302-1949"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-190",
"trust": 1.1
},
{
"problemtype": "Integer overflow or wraparound (CWE-190) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-454620"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-004519"
},
{
"db": "NVD",
"id": "CVE-2023-0754"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu92776796/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-0754"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2023-0754/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2023.1203"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/190.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-454620"
},
{
"db": "VULMON",
"id": "CVE-2023-0754"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-004519"
},
{
"db": "NVD",
"id": "CVE-2023-0754"
},
{
"db": "CNNVD",
"id": "CNNVD-202302-1949"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-454620"
},
{
"db": "VULMON",
"id": "CVE-2023-0754"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-004519"
},
{
"db": "NVD",
"id": "CVE-2023-0754"
},
{
"db": "CNNVD",
"id": "CNNVD-202302-1949"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-02-23T00:00:00",
"db": "VULHUB",
"id": "VHN-454620"
},
{
"date": "2023-02-23T00:00:00",
"db": "VULMON",
"id": "CVE-2023-0754"
},
{
"date": "2023-10-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-004519"
},
{
"date": "2023-02-23T22:15:11.333000",
"db": "NVD",
"id": "CVE-2023-0754"
},
{
"date": "2023-02-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202302-1949"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-03-03T00:00:00",
"db": "VULHUB",
"id": "VHN-454620"
},
{
"date": "2023-02-23T00:00:00",
"db": "VULMON",
"id": "CVE-2023-0754"
},
{
"date": "2023-10-31T02:04:00",
"db": "JVNDB",
"id": "JVNDB-2023-004519"
},
{
"date": "2023-11-07T04:01:23.633000",
"db": "NVD",
"id": "CVE-2023-0754"
},
{
"date": "2023-04-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202302-1949"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202302-1949"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "General\u00a0Electric\u00a0Company\u00a0 of \u00a0digital\u00a0industrial\u00a0gateway\u00a0server\u00a0 Integer overflow vulnerability in products from other vendors",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-004519"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202302-1949"
}
],
"trust": 0.6
}
}