PT-2022-1806 · Ptc · Axeda Desktop Server For Windows+1

Published 2022-03-07 · Updated 2022-03-28 · CVE-2022-25247

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Axeda agent (All versions) Axeda Desktop Server for Windows (All versions)

Description The issue allows an attacker to send certain commands to a specific port without authentication. Successful exploitation could allow a remote unauthenticated attacker to obtain full file-system access and remote code execution. The vulnerability is also related to the use of hardcoded credentials during the installation of UltraVNC, which could allow a remote attacker to gain full control over the operating system.

Recommendations For Axeda agent (All versions), consider restricting access to the specific port used by the agent to minimize the risk of exploitation. For Axeda Desktop Server for Windows (All versions), avoid using hardcoded credentials during the installation of UltraVNC until a secure alternative is implemented. As a temporary workaround, consider disabling the UltraVNC installation or restricting its use until the issue is resolved.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-01217

CVE-2022-25247

Affected Products

Axeda Desktop Server For Windows

Axeda Agent

References · 7

• https://bdu.fstec.ru/vul/2022-01217 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25247 · Vendor Advisory
• https://ptc.com/en/support/article/CS363561 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20220309.14.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25247 · Security Note
• https://securitylab.ru/news/530491.php · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-067-01 · Note