Critical severity · published Feb 23, 2023
CVE-2023-0754
The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code
9.8
CVSS
2.9%
EPSS
No
On KEV
Description
The affected products are vulnerable to an integer
overflow or wraparound, which could allow an attacker to crash the server and remotely
execute arbitrary code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Digital Industrial Gateway Server · GE
through 7.612 · source: NVD
KE
Kepserver Enterprise · Rockwellautomation
through 6.12 · source: NVD
KS
Kepware Server · Ptc
through 6.12 · source: NVD
KS
Kepware Serverex · Ptc
through 6.12 · source: NVD
TN
Thingworx .net-sdk · Ptc
through 5.8.4.971 · source: NVD
TE
Thingworx Edge C-sdk · Ptc
through 2.2.12.1052 · source: NVD
TE
Thingworx Edge Microserver · Ptc
through 5.4.10.0 · source: NVD
TI
Thingworx Industrial Connectivity · Ptc
All versions, or not specified · source: NVD
TK
Thingworx Kepware Edge · Ptc
through 1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0754
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0754
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01
More from Digital Industrial Gateway Server
9.8
CVE-2023-0755
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code