Where
-Infinity
0

Trending

Last week
Last month
Last year

PTC Axeda agentPTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

Risk 88
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and remote code execution.

Remedy

PTC recommends the following: Upgrade to Axeda agent Version 6.9.2 build 1049 or 6.9.3 build 1051 when running older versions of the Axeda agent. Configure Axeda agent and Axeda Desktop Server (ADS) to only listen on the local host interface 127.0.0.1. Refer to PTC knowledge article CS360255 Provide a unique password in the AxedaDesktop.ini file for each unit. Never use ERemoteServer in production. Make sure to delete ERemoteServer file from host device. Remove the installation file, for example: Gateway_vs2017-en-us-x64-pc-winnt-vc14-6.9.3-1051.msi When running in Windows or Linux, only allow connections to ERemoteServer from trusted hosts and block all others. When running the Windows operating system, configure Localhost communications (127.0.0.1) between ERemoteServer and Axeda Builder. Refer to PTC knowledge article CS360255 Configure the Axeda agent for the authentication information required to log in to the Axeda Deployment Utility. Refer to PTC knowledge article CS360255 PTC recommends upgrading the Axeda Desktop Server (ADS) to Version 6.9 build 215 The Axeda agent loopback-only configuration is only available in Version 6.9.1 and above. Hence, upgrading to Axeda agent 6.9.1 or above is required.
First published (updated )
CVE-2022-25247

PTC Axeda agentPTC Axeda agent and Axeda Desktop Server Use of Hard-Coded Credentials

Risk 87
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitation of this vulnerability could allow a remote authenticated attacker to take full remote control of the host operating system.

Remedy

PTC recommends the following: Upgrade to Axeda agent Version 6.9.2 build 1049 or 6.9.3 build 1051 when running older versions of the Axeda agent. Configure Axeda agent and Axeda Desktop Server (ADS) to only listen on the local host interface 127.0.0.1. Refer to PTC knowledge article CS360255 Provide a unique password in the AxedaDesktop.ini file for each unit. Never use ERemoteServer in production. Make sure to delete ERemoteServer file from host device. Remove the installation file, for example: Gateway_vs2017-en-us-x64-pc-winnt-vc14-6.9.3-1051.msi When running in Windows or Linux, only allow connections to ERemoteServer from trusted hosts and block all others. When running the Windows operating system, configure Localhost communications (127.0.0.1) between ERemoteServer and Axeda Builder. Refer to PTC knowledge article CS360255 Configure the Axeda agent for the authentication information required to log in to the Axeda Deployment Utility. Refer to PTC knowledge article CS360255 PTC recommends upgrading the Axeda Desktop Server (ADS) to Version 6.9 build 215 The Axeda agent loopback-only configuration is only available in Version 6.9.1 and above. Hence, upgrading to Axeda agent 6.9.1 or above is required.
First published (updated )
CVE-2022-25246

PTC Axeda agentPTC Axeda agent and Axeda Desktop Server Information Exposure

Risk 27
Severity
5.3
Infoleak
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service.

Remedy

PTC recommends the following: Upgrade to Axeda agent Version 6.9.2 build 1049 or 6.9.3 build 1051 when running older versions of the Axeda agent. Configure Axeda agent and Axeda Desktop Server (ADS) to only listen on the local host interface 127.0.0.1. Refer to PTC knowledge article CS360255 Provide a unique password in the AxedaDesktop.ini file for each unit. Never use ERemoteServer in production. Make sure to delete ERemoteServer file from host device. Remove the installation file, for example: Gateway_vs2017-en-us-x64-pc-winnt-vc14-6.9.3-1051.msi When running in Windows or Linux, only allow connections to ERemoteServer from trusted hosts and block all others. When running the Windows operating system, configure Localhost communications (127.0.0.1) between ERemoteServer and Axeda Builder. Refer to PTC knowledge article CS360255 Configure the Axeda agent for the authentication information required to log in to the Axeda Deployment Utility. Refer to PTC knowledge article CS360255 PTC recommends upgrading the Axeda Desktop Server (ADS) to Version 6.9 build 215 The Axeda agent loopback-only configuration is only available in Version 6.9.1 and above. Hence, upgrading to Axeda agent 6.9.1 or above is required.
First published (updated )
CVE-2022-25248

PTC Axeda agentPTC Axeda agent and Axeda Desktop Server Path Traversal

Risk 43
Severity
7.5
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to directory traversal, which could allow a remote unauthenticated attacker to obtain file system read access via web server..

Remedy

PTC recommends the following: Upgrade to Axeda agent Version 6.9.2 build 1049 or 6.9.3 build 1051 when running older versions of the Axeda agent. Configure Axeda agent and Axeda Desktop Server (ADS) to only listen on the local host interface 127.0.0.1. Refer to PTC knowledge article CS360255 Provide a unique password in the AxedaDesktop.ini file for each unit. Never use ERemoteServer in production. Make sure to delete ERemoteServer file from host device. Remove the installation file, for example: Gateway_vs2017-en-us-x64-pc-winnt-vc14-6.9.3-1051.msi When running in Windows or Linux, only allow connections to ERemoteServer from trusted hosts and block all others. When running the Windows operating system, configure Localhost communications (127.0.0.1) between ERemoteServer and Axeda Builder. Refer to PTC knowledge article CS360255 Configure the Axeda agent for the authentication information required to log in to the Axeda Deployment Utility. Refer to PTC knowledge article CS360255 PTC recommends upgrading the Axeda Desktop Server (ADS) to Version 6.9 build 215 The Axeda agent loopback-only configuration is only available in Version 6.9.1 and above. Hence, upgrading to Axeda agent 6.9.1 or above is required.
First published (updated )
CVE-2022-25249

PTC Axeda agentPTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

Risk 43
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to shut down a specific service.

Remedy

PTC recommends the following: Upgrade to Axeda agent Version 6.9.2 build 1049 or 6.9.3 build 1051 when running older versions of the Axeda agent. Configure Axeda agent and Axeda Desktop Server (ADS) to only listen on the local host interface 127.0.0.1. Refer to PTC knowledge article CS360255 Provide a unique password in the AxedaDesktop.ini file for each unit. Never use ERemoteServer in production. Make sure to delete ERemoteServer file from host device. Remove the installation file, for example: Gateway_vs2017-en-us-x64-pc-winnt-vc14-6.9.3-1051.msi When running in Windows or Linux, only allow connections to ERemoteServer from trusted hosts and block all others. When running the Windows operating system, configure Localhost communications (127.0.0.1) between ERemoteServer and Axeda Builder. Refer to PTC knowledge article CS360255 Configure the Axeda agent for the authentication information required to log in to the Axeda Deployment Utility. Refer to PTC knowledge article CS360255 PTC recommends upgrading the Axeda Desktop Server (ADS) to Version 6.9 build 215 The Axeda agent loopback-only configuration is only available in Version 6.9.1 and above. Hence, upgrading to Axeda agent 6.9.1 or above is required.
First published (updated )
CVE-2022-25250

PTC Axeda agentPTC Axeda agent and Axeda Desktop Server Improper Check or Handling Of Exceptional Conditions

Risk 44
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception. Services using said function do not handle the exception. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to crash the affected product.

Remedy

PTC recommends the following: Upgrade to Axeda agent Version 6.9.2 build 1049 or 6.9.3 build 1051 when running older versions of the Axeda agent. Configure Axeda agent and Axeda Desktop Server (ADS) to only listen on the local host interface 127.0.0.1. Refer to PTC knowledge article CS360255 Provide a unique password in the AxedaDesktop.ini file for each unit. Never use ERemoteServer in production. Make sure to delete ERemoteServer file from host device. Remove the installation file, for example: Gateway_vs2017-en-us-x64-pc-winnt-vc14-6.9.3-1051.msi When running in Windows or Linux, only allow connections to ERemoteServer from trusted hosts and block all others. When running the Windows operating system, configure Localhost communications (127.0.0.1) between ERemoteServer and Axeda Builder. Refer to PTC knowledge article CS360255 Configure the Axeda agent for the authentication information required to log in to the Axeda Deployment Utility. Refer to PTC knowledge article CS360255 PTC recommends upgrading the Axeda Desktop Server (ADS) to Version 6.9 build 215 The Axeda agent loopback-only configuration is only available in Version 6.9.1 and above. Hence, upgrading to Axeda agent 6.9.1 or above is required.
First published (updated )
CVE-2022-25252

PTC Axeda agentPTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

Risk 87
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific port without proper authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to read and modify the affected product’s configuration.

Remedy

PTC recommends the following: Upgrade to Axeda agent Version 6.9.2 build 1049 or 6.9.3 build 1051 when running older versions of the Axeda agent. Configure Axeda agent and Axeda Desktop Server (ADS) to only listen on the local host interface 127.0.0.1. Refer to PTC knowledge article CS360255 Provide a unique password in the AxedaDesktop.ini file for each unit. Never use ERemoteServer in production. Make sure to delete ERemoteServer file from host device. Remove the installation file, for example: Gateway_vs2017-en-us-x64-pc-winnt-vc14-6.9.3-1051.msi When running in Windows or Linux, only allow connections to ERemoteServer from trusted hosts and block all others. When running the Windows operating system, configure Localhost communications (127.0.0.1) between ERemoteServer and Axeda Builder. Refer to PTC knowledge article CS360255 Configure the Axeda agent for the authentication information required to log in to the Axeda Deployment Utility. Refer to PTC knowledge article CS360255 PTC recommends upgrading the Axeda Desktop Server (ADS) to Version 6.9 build 215 The Axeda agent loopback-only configuration is only available in Version 6.9.1 and above. Hence, upgrading to Axeda agent 6.9.1 or above is required.
First published (updated )
CVE-2022-25251

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203