PTC Axeda agent and Axeda Desktop Server (Update C)

🗓️ 08 Mar 2022 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics

ics🔗 www.cisa.gov👁 162 Views

PTC Axeda agent and Axeda Desktop Server (Update C) vulnerabilitie

Reporter	Title	Published	Views	Family All 65
BDU FSTEC	The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications lies in its ability to send XML messages, which allows an attacker to read and modify configuration data.	11 Mar 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications lies in its ability to send XML messages, allowing a hacker to gain full control over the operating system.	11 Mar 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications lies in its ability to send XML messages, allowing a hacker to gain full control over the operating system.	11 Mar 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications lies in the incorrect restriction on the path name to the restricted catalog, allowing a hacker to read arbitrary files.	28 Mar 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications lies in the lack of authentication for critical functions, which allows a malicious actor to disable certain services.	28 Mar 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the xBase39 module of the PTC Axed platform for creating and deploying enterprise-level applications allows a hacker to cause a service failure.	28 Mar 202200:00	–	bdu_fstec
Circl	CVE-2022-25246	16 Mar 202217:20	–	circl
Circl	CVE-2022-25249	16 Mar 202217:33	–	circl
Circl	CVE-2022-25251	16 Mar 202217:26	–	circl
CNNVD	PTC Axeda agent 信任管理问题漏洞	8 Mar 202200:00	–	cnnvd

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-067-01.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-22-067-01
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

08 Mar 2022 00:00Current

8.5High risk

Vulners AI Score8.5

CVSS 3.19.8

CVSS 210

EPSS0.03897

SSVC

ptc vendor axeda agent axeda desktop server hard-coded credentials missing authentication sensitive information exposure path traversal remote code execution vulnerability details risk evaluation update information