CVE-2023-0754

State: Published
Severity: 9.8 Critical
Published: Feb 23, 2023
Updated: Jan 16, 2025
Reserved: Feb 8, 2023

Description

The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
ThingWorx Edge C-SDKPTC	v2.2.12.1052 and earlierAffected
.NET-SDKMicrosoft	v5.8.4.971 and earlierAffected
ThingWorx Edge MicroServer (EMS)PTC	v5.4.10.0 and earlierAffected
Kepware KEPServerEXPTC	v6.12 and earlierAffected
ThingWorx Kepware ServerPTC	v6.12 and earlierAffected
ThingWorx Industrial ConnectivityPTC	All Versions Affected
ThingWorx Kepware EdgePTC	v1.5 and earlierAffected
KEPServer EnterpriseRockwell Automation	v6.12 and earlierAffected
Digital Industrial Gateway ServerGeneral Electric	v7.612 and earlierAffected

References

https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.