Where
-Infinity
0

Trending

Last week
Last month
Last year

Versions

6.14.263.0
1

GE Industrial Gateway ServerImproper Validation of Certificate with Host Mismatch in PTC KEPServerEx

Risk 31
Severity
7.5
EPSS
0.06%
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.

Remedy

PTC has released and recommends users to update to the following versions: * KEPServerEX should upgrade to v6.15 or later * ThingWorx Kepware Server should upgrade to v6.15 or later * ThingWorx Industrial Connectivity should upgrade to ThingWorx Kepware Server v6.15 or later * OPC-Aggregator should upgrade to v6.15 or later * ThingWorx Kepware Edge: Upgrade to v1.8 or later Refer to secure configuration guide here https://www.ptc.com/en/support/refdoc/ThingWorx_Kepware_Server/6.15/ThingWorx%20Kepware%20Server%20Secure%20Deployment%20Guide If additional questions remain, please contact PTC Technical Support https://support.ptc.com/apps/case_logger_viewer/cs/auth/ssl/log For more information, see PTC's advisory https://www.ptc.com/en/support/article/CS405439 .
First published (updated )
CVE-2023-5909

Out-of-bounds Read

Risk 87
Severity
9.8
Out-of-bounds Read
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.

Remedy

PTC has released the following resolutions: Update the impacted product to the latest version: ·         ThingWorx Edge C-SDK: 3.0.0 or later. ·         ThingWorx Edge MicroServer (EMS): v5.4.11 or later. ·         .NET-SDK: v5.8.5 or later. For Kepware products, the vulnerability is mitigated if the ThingWorx Interface is not enabled. To use the ThingWorx Interface without the vulnerability, update to the latest version of the product: ·         Kepware KEPServerEX: v6.13 or later. ·         ThingWorx Kepware Server (formerly ThingWorx Industrial Connectivity): v6.13 or later. ·         ThingWorx Kepware Edge: v1.6 or later. The following products should be upgraded as indicated or in accordance with the applicable organization’s recommendations if the ThingWorx Interface is in use: ·         Rockwell Automation KEPServer Enterprise: v6.13 or later. ·         GE Digital Industrial Gateway Server: v7.613 or later. For more information see PTC’s Customer Support Article .
First published (updated )
CVE-2023-0755

Integer Overflow

Risk 87
Severity
9.8
Integer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the server and remotely execute arbitrary code.

1 / 2
Source: MITRE

Remedy

PTC has released the following resolutions: Update the impacted product to the latest version: ·         ThingWorx Edge C-SDK: 3.0.0 or later. ·         ThingWorx Edge MicroServer (EMS): v5.4.11 or later. ·         .NET-SDK: v5.8.5 or later. For Kepware products, the vulnerability is mitigated if the ThingWorx Interface is not enabled. To use the ThingWorx Interface without the vulnerability, update to the latest version of the product: ·         Kepware KEPServerEX: v6.13 or later. ·         ThingWorx Kepware Server (formerly ThingWorx Industrial Connectivity): v6.13 or later. ·         ThingWorx Kepware Edge: v1.6 or later. The following products should be upgraded as indicated or in accordance with the applicable organization’s recommendations if the ThingWorx Interface is in use: ·         Rockwell Automation KEPServer Enterprise: v6.13 or later. ·         GE Digital Industrial Gateway Server: v7.613 or later. For more information see PTC’s Customer Support Article .
First published (updated )
CVE-2023-0754

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203