CVE-2023-5909

2023-11-3022:15:10

CWE-295

CWE-297

[email protected]

web.nvd.nist.gov

cve-2023-5909

kepserverex

certificate validation

unauthenticated users

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

26.9%

JSON

KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.

Affected configurations

Nvd

Node

geindustrial_gateway_serverRange≤7.614

ptckeepserverexRange≤6.14.263.0

ptcopc-aggregatorRange≤6.14

ptcthingworx_industrial_connectivityMatch-

ptcthingworx_kepware_edgeRange≤1.7

ptcthingworx_kepware_serverRange≤6.14.263.0

rockwellautomationkepserver_enterpriseRange≤6.14.263.0

softwaretoolboxtop_serverRange≤6.14.263.0

VendorProductVersionCPE
geindustrial_gateway_server*cpe:2.3:a:ge:industrial_gateway_server:*:*:*:*:*:*:*:*
ptckeepserverex*cpe:2.3:a:ptc:keepserverex:*:*:*:*:*:*:*:*
ptcopc-aggregator*cpe:2.3:a:ptc:opc-aggregator:*:*:*:*:*:*:*:*
ptcthingworx_industrial_connectivity-cpe:2.3:a:ptc:thingworx_industrial_connectivity:-:*:*:*:*:*:*:*
ptcthingworx_kepware_edge*cpe:2.3:a:ptc:thingworx_kepware_edge:*:*:*:*:*:*:*:*
ptcthingworx_kepware_server*cpe:2.3:a:ptc:thingworx_kepware_server:*:*:*:*:*:*:*:*
rockwellautomationkepserver_enterprise*cpe:2.3:a:rockwellautomation:kepserver_enterprise:*:*:*:*:*:*:*:*
softwaretoolboxtop_server*cpe:2.3:a:softwaretoolbox:top_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ge	industrial_gateway_server	*	cpe:2.3:a:ge:industrial_gateway_server::::::::
ptc	keepserverex	*	cpe:2.3:a:ptc:keepserverex::::::::
ptc	opc-aggregator	*	cpe:2.3:a:ptc:opc-aggregator::::::::
ptc	thingworx_industrial_connectivity	-	cpe:2.3:a:ptc:thingworx_industrial_connectivity:-:::::::*
ptc	thingworx_kepware_edge	*	cpe:2.3:a:ptc:thingworx_kepware_edge::::::::
ptc	thingworx_kepware_server	*	cpe:2.3:a:ptc:thingworx_kepware_server::::::::
rockwellautomation	kepserver_enterprise	*	cpe:2.3:a:rockwellautomation:kepserver_enterprise::::::::
softwaretoolbox	top_server	*	cpe:2.3:a:softwaretoolbox:top_server::::::::