CRITICAL🇵🇱 Wersja polska

CVE-2022-2848

CVSS 9.1v3.1pub. 2023-03-29upd. 2025-02-18

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-16486.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

  • Ge Industrial Gateway Server

    APP
    Ge
    < 7.612

  • Ptc Kepware Kepserverex

    APP
    Ptc
    < 6.12

  • Ptc Opc Aggregator

    APP
    Ptc
    < 6.12

  • Ptc Thingworx Industrial Connectivity

    APP
    Ptc
    wszystkie wersje

  • Ptc Thingworx Kepware Edge

    APP
    Ptc
    < 1.4

  • Ptc Thingworx Kepware Server

    APP
    Ptc
    < 6.12

  • Rockwellautomation Kepserver Enterprise

    APP
    Rockwellautomation
    < 6.12

  • Softwaretoolbox Top Server

    APP
    Softwaretoolbox
    < 6.12
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2023-5908CRITICAL9.1PL ✓ten sam produkt

Buffer overflow w KEPServerEX umożliwiający crash lub wyciek danych

CVE-2022-2825CRITICAL9.8ten sam produkt

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPS...

CVE-2023-0754CRITICAL9.8ten sam produkt

The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to ...

CVE-2023-0755CRITICAL9.8ten sam produkt

The affected products are vulnerable to an improper validation of array index, which could allow an attacker ...

CVE-2020-27265CRITICAL9.8ten sam produkt

KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All ver...