PTC KEPServerEx

🗓️ 30 Nov 2023 07:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 48 Views

PTC KEPServerEX with Heap-based Buffer Overflow and Certificate Validation Vulnerabilities, CVSS v3 9.1, affect multiple products, requires update to v6.15 or later, mitigate network exposur

Reporter	Title	Published	Views	Family All 18
BDU FSTEC	The vulnerabilities of the OPC-server software programs such as KEPServerEX, ThingWorx Kepware Server, ThingWorx Industrial Connectivity, OPC-Aggregator, ThingWorx Kepware Edge, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server, and Software Toolbox TOP Server are related to the possibility of buffer overflows in dynamic memory. This allows attackers to access protected information or cause service failures.	11 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerabilities of the OPC-server software products such as KEPServerEX, ThingWorx Kepware Server, ThingWorx Industrial Connectivity, OPC-Aggregator, ThingWorx Kepware Edge, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server, and Software Toolbox TOP Server are related to errors in the certificate validation process. These vulnerabilities allow attackers to bypass the certificate validation checks.	14 Dec 202300:00	–	bdu_fstec
Circl	CVE-2023-5908	21 Dec 202310:12	–	circl
Circl	CVE-2023-5909	21 Dec 202310:12	–	circl
CNNVD	PTC KEPServerEX Trust Management Issue Vulnerability	30 Nov 202300:00	–	cnnvd
CNNVD	PTC KEPserverEX Security Vulnerability	30 Nov 202300:00	–	cnnvd
CVE	CVE-2023-5908	30 Nov 202322:03	–	cve
CVE	CVE-2023-5909	30 Nov 202322:05	–	cve
Cvelist	CVE-2023-5908 Heap Based Buffer Overflow in PTC KEPServerEx	30 Nov 202322:03	–	cvelist
Cvelist	CVE-2023-5909 Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx	30 Nov 202322:05	–	cvelist

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-334-03.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-334-03
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

30 Nov 2023 07:00Current

9High risk

Vulners AI Score9

CVSS 3.19.1

EPSS0.00077

SSVC