Lucene search

[email protected]CVE-2023-5908

HistoryNov 30, 2023 - 10:15 p.m.

CVE-2023-5908

2023-11-3022:15:09

CWE-120

CWE-122

[email protected]

web.nvd.nist.gov

cve-2023-5908

kepserverex

buffer overflow

vulnerability

nvd

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.5%

JSON

KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.

Affected configurations

NVD

Node

geindustrial_gateway_serverRange≤7.614

ptckeepserverexRange≤6.14.263.0

ptcopc-aggregatorRange≤6.14

ptcthingworx_industrial_connectivityMatch-

ptcthingworx_kepware_edgeRange≤1.7

ptcthingworx_kepware_serverRange≤6.14.263.0

rockwellautomationkepserver_enterpriseRange≤6.14.263.0

softwaretoolboxtop_serverRange≤6.14.263.0

CPENameOperatorVersion
ge:industrial_gateway_serverge industrial gateway serverle7.614
ptc:keepserverexptc keepserverexle6.14.263.0
ptc:opc-aggregatorptc opc-aggregatorle6.14
ptc:thingworx_industrial_connectivityptc thingworx industrial connectivityeq-
ptc:thingworx_kepware_edgeptc thingworx kepware edgele1.7
ptc:thingworx_kepware_serverptc thingworx kepware serverle6.14.263.0
rockwellautomation:kepserver_enterpriserockwellautomation kepserver enterprisele6.14.263.0
softwaretoolbox:top_serversoftwaretoolbox top serverle6.14.263.0

CPE	Name	Operator	Version
ge:industrial_gateway_server	ge industrial gateway server	le	7.614
ptc:keepserverex	ptc keepserverex	le	6.14.263.0
ptc:opc-aggregator	ptc opc-aggregator	le	6.14
ptc:thingworx_industrial_connectivity	ptc thingworx industrial connectivity	eq	-
ptc:thingworx_kepware_edge	ptc thingworx kepware edge	le	1.7
ptc:thingworx_kepware_server	ptc thingworx kepware server	le	6.14.263.0
rockwellautomation:kepserver_enterprise	rockwellautomation kepserver enterprise	le	6.14.263.0
softwaretoolbox:top_server	softwaretoolbox top server	le	6.14.263.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "KEPServerEX",
    "vendor": "PTC",
    "versions": [
      {
        "lessThanOrEqual": "6.14.263.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "ThingWorx Kepware Server",
    "vendor": "PTC",
    "versions": [
      {
        "lessThanOrEqual": "6.14.263.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "ThingWorx Industrial Connectivity",
    "vendor": "PTC",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "OPC-Aggregator",
    "vendor": "PTC",
    "versions": [
      {
        "lessThanOrEqual": "6.14",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "ThingWorx Kepware Edge",
    "vendor": "PTC",
    "versions": [
      {
        "lessThanOrEqual": "1.7",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "KEPServer Enterprise",
    "vendor": "Rockwell Automation ",
    "versions": [
      {
        "lessThanOrEqual": "6.14.263.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Industrial Gateway Server",
    "vendor": "GE Gigital",
    "versions": [
      {
        "lessThanOrEqual": "7.614",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "TOP Server",
    "vendor": "Software Toolbox",
    "versions": [
      {
        "lessThanOrEqual": "6.14.263.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-334-03

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.5%

JSON

Related for CVE-2023-5908

prion1 nvd1 cvelist1 ics1