CVE-2024-6098: medium-severity vulnerability in PTC Kepware ThingWorx Kepware Server
PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.4%
When performing an online tag generation to devices which communicate
using the ControlLogix protocol, a machine-in-the-middle, or a device
that is not configured correctly, could deliver a response leading to
unrestricted or unregulated resource allocation. This could cause a
denial-of-service condition and crash the Kepware application. By
default, these functions are turned off, yet they remain accessible for
users who recognize and require their advantages.
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
GE · IGSPTC · Kepware KEPServerEXPTC · Kepware ThingWorx Kepware ServerSoftware Toolbox · TOP ServerRelated CVEs — PTC Kepware ThingWorx Kepware Server
In the same product, most dangerous first.
CVE-2023-0755CRITICALCVE-2023-0755EPSS 11.8%CVE-2023-0754CRITICALCVE-2023-0754EPSS 2.9%CVE-2023-29447MEDIUMInsufficiently Protected Credentials in PTC's Kepware KEPServerEXEPSS 0.4%CVE-2023-29446MEDIUMImproper Input Validation in PTC's Kepware KEPServerEXEPSS 0.2%CVE-2023-29445HIGHUncontrolled Search Path Element in PTC's Kepware KEPServerEXEPSS 0.2%CVE-2023-29444MEDIUMUncontrolled Search Path Element in PTC's Kepware KEPServerEXEPSS 0.2%