Riskcovery

CVE-2023-5909

Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx

State
Published
Severity
7.5 High
Published
Nov 30, 2023
Updated
Feb 25, 2026
Reserved
Nov 1, 2023

Read the record on cve.org

Description

KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nicscert

Weaknesses

  • CWE-297 Improper Validation of Certificate with Host Mismatch

Affected Products

ProductVersions
KEPServerEXPTC
  • 6.14.263.0 and earlierAffected
ThingWorx Kepware ServerPTC
  • 6.14.263.0 and earlierAffected
ThingWorx Industrial ConnectivityPTC
  • All versionsAffected
OPC-AggregatorPTC
  • 6.14 and earlierAffected
ThingWorx Kepware EdgePTC
  • 1.7 and earlierAffected
KEPServer EnterpriseRockwell Automation
  • 6.14.263.0 and earlierAffected
Industrial Gateway ServerGE Gigital
  • 7.614 and earlierAffected
TOP ServerSoftware Toolbox
  • 6.14.263.0 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.