The software vulnerabilities of Kepware KEPServerEX, ThingWorx Industrial Connectivity, OPC-Aggregator, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server allow attackers to execute arbitrary code or cause service failures.

🗓️ 22 Dec 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Vulnerabilities in Kepware KEPServerEX, ThingWorx, Open Protocol Aggregator, Rockwell KEPServer Enterprise, and GE Digital Gateway allow arbitrary code execution.

Reporter	Title	Published	Views	Family All 11
CNNVD	Multiple Kepware Product Buffer Error Vulnerabilities	17 Dec 202000:00	–	cnnvd
CVE	CVE-2020-27265	13 Jan 202123:33	–	cve
Cvelist	CVE-2020-27265	13 Jan 202123:33	–	cvelist
EUVD	EUVD-2020-19778	7 Oct 202500:30	–	euvd
ICS	PTC Kepware KEPServerEX (Update A)	17 Dec 202000:00	–	ics
NVD	CVE-2020-27265	14 Jan 202100:15	–	nvd
Tenable Nessus	Softwaretoolbox Top Out-of-bounds Write	10 Aug 202100:00	–	nessus
Tenable Nessus	PTC OPC UA Server Multiple vulnerabilities	17 May 202100:00	–	nessus
Tenable Nessus	Rockwell (CVE-2020-27265) (deprecated)	7 Feb 202200:00	–	nessus
Prion	Stack overflow	14 Jan 202100:15	–	prion

Vulners

Node

ptc kepware_kepserverexRange6.6–6.6.362.0

ptc kepware_kepserverexRange6.7–6.7.1067.0

ptc kepware_kepserverexRange6.8–6.8.838.0

ptc kepware_kepserverexRange6.9–6.9.584.0

ptc opc-aggregatorRange6.9–6.9.584.0

rockwell_automation kepserver_enterpriseRange6.6–6.6.550.0

rockwell_automation kepserver_enterpriseRange6.9–6.9.584.0

general_electric_company digital_industrial_gateway_serverRange7.68.804–7.68.839.0

general_electric_company digital_industrial_gateway_serverRange7.66–7.68.839.0

Source	Link
us-cert	www.us-cert.cisa.gov/ics/advisories/icsa-20-352-02
web	www.web.nvd.nist.gov/view/vuln/detail
cisa	www.cisa.gov/news-events/ics-advisories/icsa-20-352-02

22 Dec 2023 00:00Current

8.6High risk

Vulners AI Score8.6

CVSS 39.8

CVSS 210

EPSS0.10062