PT-2022-1929 · Ptc · Axeda Desktop Server For Windows+1

Published 2022-03-07 · Updated 2022-03-28 · CVE-2022-25249

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Axeda agent versions prior to 6.9.2 Axeda agent versions prior to 6.9.3 Axeda Desktop Server for Windows (all versions)

Description The issue is related to incorrect restriction of a directory path name with limited access. This could allow a remote unauthenticated attacker to read arbitrary files by sending a specially crafted HTTP request, potentially obtaining file system read access via the web server.

Recommendations For Axeda agent versions prior to 6.9.2, update to version 6.9.2 or later. For Axeda agent versions prior to 6.9.3, update to version 6.9.3 or later. For Axeda Desktop Server for Windows, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the web server to minimize the risk of exploitation.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-01467

CVE-2022-25249

Affected Products

Axeda Desktop Server For Windows

Axeda Agent

References · 8

• https://bdu.fstec.ru/vul/2022-01467 · Security Note
• https://ptc.com/en/support/article/CS363561 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20220309.14.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25249 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25249 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2022030905 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-067-01 · Note
• https://t.me/cibsecurity/39075 · Telegram Post