Heap-Based Buffer Overflow in KEPServerEX and Other Industrial Connectivity Products
CVE-2020-27263

9.1CRITICAL

Key Information:

Vendor

Ptc

Status
Ptc Kepware Kepserverex
Thingworx Kepware Server
Thingworx Industrial Connectivity
Opc-aggregator
Vendor
CVE Published:
14 January 2021

What is CVE-2020-27263?

A heap-based buffer overflow vulnerability exists in KEPServerEX, ThingWorx Kepware Server, and other related products. An attacker can exploit this vulnerability by sending a specifically crafted OPC UA message to the server, which could lead to server crashes and potential data leaks. This issue affects multiple versions across various industrial connectivity products, making it essential for organizations to mitigate risks associated with this vulnerability.

Affected Version(s)

GE Digital Industrial Gateway Server v7.68.804

GE Digital Industrial Gateway Server v7.66

OPC-Aggregator All versions

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-352-02
x_refsource_MISC

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.