CVE-2023-29445: falha de alta gravidade em PTC Kepware KEPServerEX
Uncontrolled Search Path Element in PTC's Kepware KEPServerEX
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.8epss 0.2%
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
PTC · Kepware KEPServerEXPTC · ThingWorx Industrial ConnectivityPTC · ThingWorx Kepware ServerCVEs relacionadas — PTC Kepware KEPServerEX
No mesmo produto, das mais perigosas para as menos.
CVE-2023-0755CRITICALCVE-2023-0755EPSS 11.8%CVE-2023-0754CRITICALCVE-2023-0754EPSS 2.9%CVE-2023-5908CRITICALHeap Based Buffer Overflow in PTC KEPServerExEPSS 1.0%CVE-2023-5909HIGHImproper Validation of Certificate with Host Mismatch in PTC KEPServerExEPSS 0.4%CVE-2024-6098MEDIUMPTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or ThrottlingEPSS 0.4%CVE-2023-29447MEDIUMInsufficiently Protected Credentials in PTC's Kepware KEPServerEXEPSS 0.4%