Critical severity · published Mar 29, 2023
CVE-2022-2825
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0
9.8
CVSS
3.4%
EPSS
No
On KEV
Description
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-18411.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IG
Industrial Gateway Server · GE
before 7.612 · source: NVD
KE
Kepserver Enterprise · Rockwellautomation
before 6.12 · source: NVD
KK
Kepware Kepserverex · Ptc
before 6.12 · source: NVD
OP
Opc-aggregator · Ptc
before 6.12 · source: NVD
TI
Thingworx Industrial Connectivity · Ptc
All versions, or not specified · source: NVD
TK
Thingworx Kepware Edge · Ptc
before 1.4 · source: NVD
TK
Thingworx Kepware Server · Ptc
before 6.12 · source: NVD
TS
Top Server · Softwaretoolbox
before 6.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2825
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2825
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1455/
More from Industrial Gateway Server
9.8
CVE-2020-27265
KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer…
9.1
CVE-2023-5908
KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information
9.1
CVE-2022-2848
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0
9.1
CVE-2020-27267
KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer…
9.1
CVE-2020-27263
KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer…