Integer Overflow Vulnerability in Affected Product by Vendor
CVE-2023-0754

9.8CRITICAL

Key Information:

Vendor

Ptc

Status
Thingworx Edge C-sdk
.net-sdk
Thingworx Edge Microserver (ems)
Kepware Kepserverex
Vendor
CVE Published:
23 February 2023

What is CVE-2023-0754?

This vulnerability stems from an integer overflow or wraparound in the affected products, which could be exploited by an attacker to crash the server. Furthermore, if successfully exploited, it opens a pathway for remote execution of arbitrary code, potentially compromising the integrity and availability of the system.

Affected Version(s)

.NET-SDK 0

Digital Industrial Gateway Server 0

KEPServer Enterprise 0

References

https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chris Anastasio and Steven Seeley of Incite Team reported these vulnerabilities to CISA.
.