Improper Validation of Array Index in PTC products - CVE-2023-0755

Vulnerability identifier: #VU72578

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-0755

CWE-ID: CWE-129

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to an improper validation of array index. A remote attacker can execute arbitrary code on the target system.

ThingWorx Edge C-SDK
.NET-SDK
ThingWorx Edge MicroServer (EMS)
ThingWorx Kepware Server
ThingWorx Industrial Connectivity
ThingWorx Kepware Edge
KEPServer Enterprise
Industrial Gateway Server
KEPServerEX

Install updates from vendor's website.

ThingWorx Edge C-SDK - update to 3.0.0
.NET-SDK - update to 5.8.5
ThingWorx Edge MicroServer (EMS) - update to 5.4.11
ThingWorx Kepware Server - update to 6.13
ThingWorx Kepware Edge - update to 1.6
KEPServerEX - update to 6.13
KEPServer Enterprise - update to 6.13
Industrial Gateway Server - update to 7.613

• https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01

• Multiple vulnerabilities in PTC ThingWorx Edge
• Multiple vulnerabilities in Kepware KEPServerEX
• Multiple vulnerabilities in Rockwell Automation KEPServer Enterprise
• Multiple vulnerabilities in GE Digital Industrial Gateway Server