CVE-2020-27267CWE-416

CVE-2020-27267: vulnerability in ThingWorx Kepware Server

Published · Updated

Follow this CVE+ Monitor Kepware KEPServerEX+ Monitor KEPServer Enterprise

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 6.0%
KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server all 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.
Affected products
n/a · GE Digital Industrial Gateway Servern/a · OPC-Aggregatorn/a · PTC Kepware KEPServerEXn/a · Rockwell Automation KEPServer Enterprisen/a · Software Toolbox TOP Servern/a · ThingWorx Industrial Connectivityn/a · ThingWorx Kepware Server