ICSA-23-054-01

PTC ThingWorx Edge

view advisory published 2023-02-27

Successful exploitation of these vulnerabilities could allow an attacker to crash the device they accessed or could allow remote code execution.

describes (2)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-0755US	critical9.8	11.8% (96th)	—	2023-02-23
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.
CVE-2023-0754US	critical9.8	2.94% (87th)	—	2023-02-23
The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code.

references

External citations — patches, advisories, analysis.

Recommended Practicesexternal
ICS Advisory ICSA-23-054-01 JSONself
Recommended Practicesexternal
ICS Advisory ICSA-23-054-01 Web Versionself
Recommended Practicesexternal

remediations (36)

Mitigation.NET-SDK
.NET-SDK: v5.8.5 or later.
Mitigation.NET-SDK
.NET-SDK: v5.8.5 or later.
MitigationGE Digital Industrial Gateway Server
.NET-SDK: v5.8.5 or later.
MitigationGE Digital Industrial Gateway Server
.NET-SDK: v5.8.5 or later.
MitigationKepware KEPServerEX
.NET-SDK: v5.8.5 or later.
MitigationKepware KEPServerEX
.NET-SDK: v5.8.5 or later.
MitigationRockwell Automation KEPServer Enterprise
.NET-SDK: v5.8.5 or later.
MitigationRockwell Automation KEPServer Enterprise
.NET-SDK: v5.8.5 or later.
MitigationThingWorx Edge C-SDK
.NET-SDK: v5.8.5 or later.
MitigationThingWorx Edge C-SDK
.NET-SDK: v5.8.5 or later.
MitigationThingWorx Edge MicroServer (EMS)
.NET-SDK: v5.8.5 or later.
MitigationThingWorx Edge MicroServer (EMS)
.NET-SDK: v5.8.5 or later.
MitigationThingWorx Industrial Connectivity
.NET-SDK: v5.8.5 or later.
MitigationThingWorx Industrial Connectivity
.NET-SDK: v5.8.5 or later.
MitigationThingWorx Kepware Edge
.NET-SDK: v5.8.5 or later.
MitigationThingWorx Kepware Edge
.NET-SDK: v5.8.5 or later.
MitigationThingWorx Kepware Server (formerly ThingWorx Industrial Connectivity)
.NET-SDK: v5.8.5 or later.
MitigationThingWorx Kepware Server (formerly ThingWorx Industrial Connectivity)
.NET-SDK: v5.8.5 or later.
Fixed.NET-SDK
GE Digital Industrial Gateway Server: v7.613 or later.
Fixed.NET-SDK
GE Digital Industrial Gateway Server: v7.613 or later.
FixedGE Digital Industrial Gateway Server
GE Digital Industrial Gateway Server: v7.613 or later.
FixedGE Digital Industrial Gateway Server
GE Digital Industrial Gateway Server: v7.613 or later.
FixedKepware KEPServerEX
GE Digital Industrial Gateway Server: v7.613 or later.
FixedKepware KEPServerEX
GE Digital Industrial Gateway Server: v7.613 or later.
FixedRockwell Automation KEPServer Enterprise
GE Digital Industrial Gateway Server: v7.613 or later.
FixedRockwell Automation KEPServer Enterprise
GE Digital Industrial Gateway Server: v7.613 or later.
FixedThingWorx Edge C-SDK
GE Digital Industrial Gateway Server: v7.613 or later.
FixedThingWorx Edge C-SDK
GE Digital Industrial Gateway Server: v7.613 or later.
FixedThingWorx Edge MicroServer (EMS)
GE Digital Industrial Gateway Server: v7.613 or later.
FixedThingWorx Edge MicroServer (EMS)
GE Digital Industrial Gateway Server: v7.613 or later.
FixedThingWorx Industrial Connectivity
GE Digital Industrial Gateway Server: v7.613 or later.
FixedThingWorx Industrial Connectivity
GE Digital Industrial Gateway Server: v7.613 or later.
FixedThingWorx Kepware Edge
GE Digital Industrial Gateway Server: v7.613 or later.
FixedThingWorx Kepware Edge
GE Digital Industrial Gateway Server: v7.613 or later.
FixedThingWorx Kepware Server (formerly ThingWorx Industrial Connectivity)
GE Digital Industrial Gateway Server: v7.613 or later.
FixedThingWorx Kepware Server (formerly ThingWorx Industrial Connectivity)
GE Digital Industrial Gateway Server: v7.613 or later.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan