CVE-2022-25248: PTC Axeda agent and Axeda Desktop Server Information Exposure
Published Mar 16, 2022
·Updated
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service.
Affected Software
4 affected components
PTC Axeda agent<6.9.1
PTC Axeda Desktop Server Windows<6.9.215
PTC Axeda agent
PTC Axeda Desktop Server for Windows
Remediation
Information
PTC recommends the following:
Upgrade to Axeda agent Version 6.9.2 build 1049 or 6.9.3 build 1051 when running older versions of the Axeda agent.
Configure Axeda agent and Axeda Desktop Server (ADS) to only listen on the local host interface 127.0.0.1. Refer to PTC knowledge article CS360255
Provide a unique password in the AxedaDesktop.ini file for each unit.
Never use ERemoteServer in production.
Make sure to delete ERemoteServer file from host device.
Remove the installation file, for example: Gateway_vs2017-en-us-x64-pc-winnt-vc14-6.9.3-1051.msi
When running in Windows or Linux, only allow connections to ERemoteServer from trusted hosts and block all others.
When running the Windows operating system, configure Localhost communications (127.0.0.1) between ERemoteServer and Axeda Builder. Refer to PTC knowledge article CS360255
Configure the Axeda agent for the authentication information required to log in to the Axeda Deployment Utility. Refer to PTC knowledge article CS360255
PTC recommends upgrading the Axeda Desktop Server (ADS) to Version 6.9 build 215
The Axeda agent loopback-only configuration is only available in Version 6.9.1 and above. Hence, upgrading to Axeda agent 6.9.1 or above is required.
Event History
Mar 16, 2022
CVE Published
via MITRE·02:03 PM
Data Sourced
via MITRE·02:03 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-25248.
2
What software versions are affected by this vulnerability?
The Axeda agent versions up to 6.9.1 and Axeda Desktop Server for Windows versions up to 6.9.215 are affected.
3
What is the severity of CVE-2022-25248?
The severity of CVE-2022-25248 is medium with a severity value of 5.3.
4
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-200.
5
How can I fix this vulnerability?
To fix this vulnerability, it is recommended to update the Axeda agent to version 6.9.1 or higher and the Axeda Desktop Server for Windows to version 6.9.215 or higher.