CVE-2023-29445

2024-01-1021:15:08

CWE-427

[email protected]

web.nvd.nist.gov

dll hijacking

privilege escalation

cve-2023-29445

uncontrolled search path

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

0.4%

JSON

An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.

Affected configurations

Nvd

Node

ptckepware_kepserverexRange6.0.2107.0–6.14.263.0

Node

ptcthingworx_kepware_serverRange6.8–6.14.263.0

Node

ptcthingworx_industrial_connectivityRange8.0–8.5

VendorProductVersionCPE
ptckepware_kepserverex*cpe:2.3:a:ptc:kepware_kepserverex:*:*:*:*:*:*:*:*
ptcthingworx_kepware_server*cpe:2.3:a:ptc:thingworx_kepware_server:*:*:*:*:*:*:*:*
ptcthingworx_industrial_connectivity*cpe:2.3:a:ptc:thingworx_industrial_connectivity:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ptc	kepware_kepserverex	*	cpe:2.3:a:ptc:kepware_kepserverex::::::::
ptc	thingworx_kepware_server	*	cpe:2.3:a:ptc:thingworx_kepware_server::::::::
ptc	thingworx_industrial_connectivity	*	cpe:2.3:a:ptc:thingworx_industrial_connectivity::::::::