PT-2022-1932 · Ptc · Ptc Axeda Axeda Agent+1

Published 2022-03-16 · Updated 2022-03-28 · CVE-2022-25252

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PTC Axeda Axeda agent versions All PTC Axeda Axeda Desktop Server for Windows versions All

Description The issue is related to incorrect exception handling in the xBase39 module of the PTC Axeda platform. This can be exploited by a remote attacker to cause a denial of service. When the Axeda agent or Axeda Desktop Server for Windows receives certain input on a specific port, it throws an exception that is not properly handled by services using the affected function, leading to a crash of the product.

Recommendations For PTC Axeda Axeda agent versions All, consider restricting access to the specific port that triggers the exception to minimize the risk of exploitation. For PTC Axeda Axeda Desktop Server for Windows versions All, avoid using the function that throws the exception until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-703

Related Identifiers

BDU:2022-01470

CVE-2022-25252

Affected Products

Axeda Desktop Server For Windows

Ptc Axeda Axeda Agent

References · 6

• https://osv.dev/vulnerability/CVE-2022-25252 · Vendor Advisory
• https://ptc.com/en/support/article/CS363561 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20220309.14.pdf · Security Note
• https://bdu.fstec.ru/vul/2022-01470 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25252 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-067-01 · Note