PT-2022-1930 · Ptc · Axeda Desktop Server For Windows+1

Published 2022-03-07 · Updated 2022-03-28 · CVE-2022-25250

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Axeda agent (All versions) Axeda Desktop Server for Windows (All versions)

Description The issue is related to a lack of authentication for a critical function, allowing a remote unauthenticated attacker to send a certain command to a specific port. This could enable the attacker to shut down a specific service. The estimated number of potentially affected devices worldwide is not available.

Recommendations For Axeda agent (All versions), consider restricting access to the critical function to minimize the risk of exploitation. For Axeda Desktop Server for Windows (All versions), avoid using the vulnerable function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-01468

CVE-2022-25250

Affected Products

Axeda Desktop Server For Windows

Axeda Agent

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-25250 · Security Note
• https://ptc.com/en/support/article/CS363561 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01468 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20220309.14.pdf · Security Note
• https://osv.dev/vulnerability/CVE-2022-25250 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2022030905 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-067-01 · Note