Lucene search

IcscertCVELIST:CVE-2022-25249

HistoryMar 16, 2022 - 2:03 p.m.

CVE-2022-25249 PTC Axeda agent and Axeda Desktop Server Path Traversal

2022-03-1614:03:33

CWE-22

icscert

www.cve.org

cve-2022-25249

ptc axeda

desktop server

path traversal

vulnerability

directory traversal

remote attacker

unauthenticated access

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

High

EPSS

0.002

Percentile

58.9%

JSON

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to directory traversal, which could allow a remote unauthenticated attacker to obtain file system read access via web server…

CNA Affected

[
  {
    "product": "Axeda agent",
    "vendor": "PTC",
    "versions": [
      {
        "status": "affected",
        "version": "All Versions"
      }
    ]
  },
  {
    "product": "Axeda Desktop Server for Windows",
    "vendor": "PTC",
    "versions": [
      {
        "status": "affected",
        "version": "All Versions"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-22-067-01

www.ptc.com/en/support/article/CS363561

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

High

EPSS

0.002

Percentile

58.9%

JSON

Related for CVELIST:CVE-2022-25249