Login Request a demo
High severity · published Mar 16, 2022
CVE-2022-25252
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception
7.5
CVSS
1.6%
EPSS
No
On KEV
Description
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception. Services using said function do not handle the exception. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to crash the affected product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Axeda Agent · Ptc
before 6.9.1 · source: NVD
AD
Axeda Desktop Server · Ptc
before 6.9.215 · source: NVD
Affected product
AA
Axeda Agent
Ptc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25252
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25252
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01
Vendor Advisory
https://www.ptc.com/en/support/article/CS363561
More from Axeda Agent
9.8
CVE-2022-25251
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific…
9.8
CVE-2022-25247
Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication
8.8
CVE-2022-25246
Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation
7.5
CVE-2022-25250
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port…
7.5
CVE-2022-25249
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to…