Integer overflow in PTC products - CVE-2023-0754

Vulnerability identifier: #VU72579

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-0754

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

ThingWorx Edge C-SDK
.NET-SDK
ThingWorx Edge MicroServer (EMS)
ThingWorx Kepware Server
ThingWorx Industrial Connectivity
ThingWorx Kepware Edge
KEPServer Enterprise
Industrial Gateway Server
KEPServerEX

Install updates from vendor's website.

ThingWorx Edge C-SDK - update to 3.0.0
.NET-SDK - update to 5.8.5
ThingWorx Edge MicroServer (EMS) - update to 5.4.11
ThingWorx Kepware Server - update to 6.13
ThingWorx Kepware Edge - update to 1.6
KEPServerEX - update to 6.13
KEPServer Enterprise - update to 6.13
Industrial Gateway Server - update to 7.613

• https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01

• Multiple vulnerabilities in PTC ThingWorx Edge
• Multiple vulnerabilities in Kepware KEPServerEX
• Multiple vulnerabilities in Rockwell Automation KEPServer Enterprise
• Multiple vulnerabilities in GE Digital Industrial Gateway Server