Vulnerabilities > PTC > Thingworx Kepware Server

DATE CVE VULNERABILITY TITLE RISK
2024-01-10 CVE-2023-29445 Uncontrolled Search Path Element vulnerability in PTC products
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.
local
low complexity
ptc CWE-427
7.8
2024-01-10 CVE-2023-29446 Improper Input Validation vulnerability in PTC products
An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file.
local
high complexity
ptc CWE-20
4.7
2024-01-10 CVE-2023-29447 Insufficiently Protected Credentials vulnerability in PTC products
An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.
high complexity
ptc CWE-522
5.3
2024-01-10 CVE-2023-29444 Uncontrolled Search Path Element vulnerability in PTC products
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.
local
low complexity
ptc CWE-427
7.3
2023-11-30 CVE-2023-5908 Classic Buffer Overflow vulnerability in multiple products
KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.
network
low complexity
ptc softwaretoolbox ge rockwellautomation CWE-120
critical
9.1
2023-11-30 CVE-2023-5909 Improper Certificate Validation vulnerability in multiple products
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.
7.5
2023-03-29 CVE-2022-2825 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0.
network
low complexity
ptc softwaretoolbox rockwellautomation ge
critical
9.8
2023-03-29 CVE-2022-2848 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0.
network
low complexity
ptc softwaretoolbox rockwellautomation ge
critical
9.1
2021-01-14 CVE-2020-27267 Out-of-bounds Write vulnerability in multiple products
KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server all 6.x versions, are vulnerable to a heap-based buffer overflow.
network
low complexity
ptc ge rockwellautomation softwaretoolbox CWE-787
critical
9.1
2021-01-14 CVE-2020-27265 Out-of-bounds Write vulnerability in multiple products
KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions are vulnerable to a stack-based buffer overflow.
network
low complexity
ptc ge rockwellautomation softwaretoolbox CWE-787
critical
9.8