Uncontrolled Search Path Element in PTC's Kepware KEPServerEX

CVE-2023-29445

What is CVE-2023-29445?

A vulnerability exists in PTC KEPServerEX due to an uncontrolled search path element, commonly referred to as DLL hijacking. This flaw can be exploited by a locally authenticated attacker, granting them the ability to escalate their privileges to SYSTEM level. When an application executes, it may inadvertently load a malicious dynamic link library (DLL) instead of the intended one. This vulnerability poses risks to system integrity and security, making sensitive data and critical operations vulnerable to compromise if exploited.

References