PT-2023-7668 · Ptc+4 · Thingworx Kepware Server+6

Shawn Hoffman · Published 2023-11-30 · Updated 2023-12-06 · CVE-2023-5909

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions KEPServerEX (affected versions not specified) ThingWorx Kepware Server (affected versions not specified) ThingWorx Industrial Connectivity (affected versions not specified) OPC-Aggregator (affected versions not specified) ThingWorx Kepware Edge (affected versions not specified) Rockwell Automation KEPServer Enterprise (affected versions not specified) GE Digital Industrial Gateway Server (affected versions not specified) Software Toolbox TOP Server (affected versions not specified)

Description The issue is related to errors in the certificate authentication procedure, which may allow unauthenticated users to connect. Exploitation of this issue could enable a remote attacker to bypass certificate policy checks.

Recommendations For KEPServerEX, consider disabling certificate validation until a proper fix is available. For ThingWorx Kepware Server, restrict access to sensitive areas of the server to minimize the risk of exploitation. For ThingWorx Industrial Connectivity, avoid using the vulnerable authentication mechanism until the issue is resolved. For OPC-Aggregator, as a temporary workaround, consider implementing additional authentication measures to mitigate the risk. For ThingWorx Kepware Edge, restrict access to the Edge server to prevent potential exploitation. For Rockwell Automation KEPServer Enterprise, consider applying configuration changes to enhance security and prevent exploitation. For GE Digital Industrial Gateway Server, avoid using the affected server for critical operations until the issue is fixed. For Software Toolbox TOP Server, consider disabling the vulnerable component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-297

Related Identifiers

BDU:2023-08729

CVE-2023-5909

Affected Products

Ge Digital Industrial Gateway Server

Kepserverex

Rockwell Automation Kepserver Enterprise

Software Toolbox Top Server

Thingworx Industrial Connectivity

Thingworx Kepware Edge

Thingworx Kepware Server

References · 7

• https://osv.dev/vulnerability/CVE-2023-5909 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08729 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5909 · Security Note
• https://twitter.com/RedPacketSec/status/1731616111886487862 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-334-03 · Note
• https://t.me/cvenotify/61831 · Telegram Post
• https://t.me/cvenotify/62588 · Telegram Post