PT-2022-1804 · Ptc · Axeda Desktop Server For Windows+1

Published 2022-03-07 · Updated 2022-03-28 · CVE-2022-25251

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Axeda agent (All versions) Axeda Desktop Server for Windows (All versions)

Description The issue allows an attacker to send certain XML messages to a specific port without proper authentication, potentially enabling a remote unauthenticated attacker to read and modify the affected product's configuration.

Recommendations For Axeda agent (All versions), consider restricting access to the specific port that allows XML messages to be sent without proper authentication until a fix is available. For Axeda Desktop Server for Windows (All versions), as a temporary workaround, consider disabling the ability to send XML messages to the specific port until a patch is available. Avoid using the affected products until the issue is resolved, as there is no information about a newer version that contains a fix for this issue.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-01215

CVE-2022-25251

Affected Products

Axeda Desktop Server For Windows

Axeda Agent

References · 8

• https://ptc.com/en/support/article/CS363561 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20220309.14.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25251 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25251 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01215 · Security Note
• https://securitylab.ru/news/530491.php · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-067-01 · Note
• https://t.me/cibsecurity/39063 · Telegram Post