CVE-2024-6098: PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling
When performing an online tag generation to devices which communicate using the ControlLogix protocol, a machine-in-the-middle, or a device that is not configured correctly, could deliver a response leading to unrestricted or unregulated resource allocation. This could cause a denial-of-service condition and crash the Kepware application. By default, these functions are turned off, yet they remain accessible for users who recognize and require their advantages.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6098?
CVE-2024-6098 is considered a critical vulnerability due to its potential impact on resource allocation and system integrity.
How do I fix CVE-2024-6098?
To fix CVE-2024-6098, ensure that your PTC Kepware Server is updated to the latest version and re-evaluate the configuration of devices communicating via the ControlLogix protocol.
What systems are affected by CVE-2024-6098?
CVE-2024-6098 specifically affects PTC Kepware Server when devices communicate using the ControlLogix protocol.
What are the risks associated with CVE-2024-6098?
The risks associated with CVE-2024-6098 include unauthorized resource allocation and potential disruption of services due to machine-in-the-middle attacks.
Is there a workaround for CVE-2024-6098?
While the recommended fix is to update the software, ensuring proper configuration of network devices and monitoring network traffic can serve as temporary workarounds.