PTC KEPServerEX Trust Management Issue Vulnerability

PTC KEPserverEX is a connectivity platform from PTC. Users can connect, manage, monitor and control a variety of automation devices and software applications through an intuitive user interface. A security vulnerability exists in PTC KEPServerEX version v6.14.263.0 and prior versions, which stems...

CVE-2023-5908: Heap-based Buffer Overflow

KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information...

The vulnerability of Kepware OPC-server software from Kepware KEPServerEX and ThingWorkx Kepware Server lies in the insufficient validation of input data, allowing attackers to access confidential information.

The vulnerability of the OPC-server software from Kepware, KEPServerEX, and ThingWorkx Kepware Server, lies in insufficient validation of input data. Exploiting this vulnerability can allow attackers to access confidential information by loading any arbitrary project file...

The vulnerability of Kepware KEPServerEX and Kepware Server’s software lies in the insufficient protection of registration data, allowing attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the OPC-server software from Kepware, KEPServerEX and ThingWorkx Kepware Server, is related to insufficient protection for registration data. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...

The vulnerability of the OPC-server software from Kepware, KEPServerEX and ThingWorkx Kepware Server, related to an uncontrolled element in the search process, allows a hacker to increase privileges within the system and load any desired DLL library.

The vulnerability of the OPC-server software from Kepware, KEPServerEX and ThingWorkx Kepware Server, is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow a hacker to increase their privileges within the system and load any desired DLL libraries...

PTC Kepware KEPServerEX Security Vulnerability

PTC Kepware KEPServerEX is an industrial automation data connectivity solution from PTC Corporation. A security vulnerability exists in PTC Kepware KEPServerEX 6.14.263.0 and prior versions, which stems from the Web server's use of basic authentication to protect user credentials, and can be...

PTC Kepware KEPServerEX Input Validation Error Vulnerability

PTC Kepware KEPServerEX is an industrial automation data connectivity solution from PTC Corporation. PTC Kepware KEPServerEX 6.14.263.0 and earlier versions suffer from an input validation error vulnerability that stems from easy UNC path injection via a malicious project file.By tricking a user...

PTC Kepware KEPServerEX Security Vulnerability

PTC Kepware KEPServerEX is an industrial automation data connectivity solution from PTC Corporation. A security vulnerability exists in PTC Kepware KepServerEX 6.14.263.0 and prior versions, which originates from a locally authenticated attacker who can escalate privileges to administrator by...

PTC Kepware KEPServerEX Security Vulnerability

PTC Kepware KEPServerEX is an industrial automation data connectivity solution from PTC Corporation. A security vulnerability exists in PTC Kepware KEPServerEX 6.14.263.0 and earlier versions, which stems from the vulnerability of KEPServerEX's installer to DLL search order hijacking, which could...

PTC Kepware KepServerEX (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION : Exploitable remotely/low attack complexity Vendor : PTC Equipment : Kepware KepServerEX Vulnerabilities : Uncontrolled Search Path Element, Improper Input Validation, Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of...

PT-2023-5234 · Kepware +1 · Kepserverex +1

Name of the Vulnerable Software and Affected Versions: KEPServerEX versions affected versions not specified ThingWorx Kepware Server versions affected versions not specified Description: The issue is related to an uncontrolled search path element, which could allow a locally authenticated adversa...

PT-2023-5235 · Kepware +1 · Kepserverex +1

Name of the Vulnerable Software and Affected Versions: KEPServerEX versions affected versions not specified ThingWorx Kepware Server versions affected versions not specified Description: The issue is related to an uncontrolled search path element vulnerability, also known as DLL hijacking. This...

PT-2023-5232 · Kepware · Kepserverex

Name of the Vulnerable Software and Affected Versions: KEPServerEX affected versions not specified Description: The issue is related to insufficient protection of credentials in KEPServerEX, allowing an adversary to capture user credentials due to the web server's use of basic authentication. Thi...

CVE-2023-3825

PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a...

CVE-2023-3825

PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a...

Design/Logic Flaw

PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a...

CVE-2023-3825

PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a...

CVE-2023-3825

PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a...

CVE-2023-3825

CVE-2023-3825 affects PTC KEPServerEX (Versions 6.0–6.14.263). The root cause is the OPC UA message decoder not validating recursively defined objects, enabling an attacker to trigger uncontrolled resource consumption, potentially causing stack overflow and device crash (DoS). Public sources cons...

CVE-2023-3825: Uncontrolled Resource Consumption

PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a...