PT-2023-5233 · Kepware+1 · Kepware Kepserverex+1

Sam Hanson · Publicado 2023-08-31 · Atualizado 2024-10-08 · CVE-2023-29446

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kepware KEPServerEX versions (affected versions not specified) ThingWorx Kepware Server versions (affected versions not specified)

Description The issue is related to insufficient input validation, which can be exploited by an adversary to gain access to confidential information. This can be achieved by uploading a malicious project file, allowing the adversary to inject a UNC path and capture NLTMv2 hashes, potentially cracking them offline.

Recommendations For Kepware KEPServerEX, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ThingWorx Kepware Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

CWE-40

Identificadores relacionados

BDU:2023-05845

CVE-2023-29446

Produtos afetados

Kepware Kepserverex

Thingworx Kepware Server

Referências · 12

• https://cybersecurity-help.cz/vdb/SB2023090139 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-29446 · Nota de Segurança
• https://ptc.com/en/support/article/cs399528 · Aviso do Fabricante
• https://vuldb.com/ru/?id.238499 · Nota
• https://dragos.com/advisory/ptcs-kepserverex-vulnerabilities · Nota
• https://t.me/cvenotify/67045 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-29446 · Aviso do Fabricante
• https://t.me/cvenotify/66968 · Publicação no Telegram
• https://cisa.gov/news-events/ics-advisories/icsa-23-243-03 · Nota
• https://bdu.fstec.ru/vul/2023-05845 · Nota de Segurança
• https://t.me/cvenotify/68077 · Publicação no Telegram
• https://t.me/cvenotify/97467 · Publicação no Telegram