CVE-2023-29445: Uncontrolled Search Path Element in PTC's Kepware KEPServerEX
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29445?
CVE-2023-29445 is a high-severity vulnerability that allows escalation of privileges to SYSTEM due to an uncontrolled search path element issue.
How do I fix CVE-2023-29445?
To mitigate CVE-2023-29445, ensure that PTC KEPServerEX and ThingWorx Kepware Server are updated to the latest versions that address this vulnerability.
Who is affected by CVE-2023-29445?
CVE-2023-29445 affects versions of PTC KEPServerEX, ThingWorx Kepware Server, and ThingWorx Industrial Connectivity within specified version ranges.
What type of vulnerability is CVE-2023-29445?
CVE-2023-29445 is classified as a DLL hijacking vulnerability, which allows an attacker to manipulate the search path for dynamic link libraries.
Can CVE-2023-29445 be exploited remotely?
No, CVE-2023-29445 requires local authentication, meaning that an attacker must have local access to the affected system to exploit it.