Skip to content
OpenAdvisories
Critical ICSA-22-067-01 7 CVEs

PTC Axeda agent and Axeda Desktop Server (Update C)

Published Mar 8, 2022 · Updated Mar 31, 2022 · Revision 4

Vendor: PTC Product: Axeda agent Product: Axeda Desktop Server for Windows

Summary

Successful exploitation of these vulnerabilities could result in full system access, remote code execution, read/change configuration, file system read access, log information access, and a denial-of-service condition.

Vulnerabilities 7

  • Critical 9.8
    CVE-2022-25246

    PTC Axeda agent and Axeda Desktop Server Use of Hard-Coded Credentials

    Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitation of this vulnerability could allow a remote authenticated attacker to take full remote control of …

    PTC Axeda agent Axeda Desktop Server for Windows Windows
  • Critical 9.8
    CVE-2022-25247

    PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

    Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacke…

    PTC Axeda Desktop Server for Windows Axeda agent Windows
  • Critical 9.8
    CVE-2022-25251

    PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

    When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific port without proper authentication. Successful exploitation of this vulnerability…

    PTC Axeda agent Axeda Desktop Server for Windows Windows
  • High 7.5
    CVE-2022-25249

    PTC Axeda agent and Axeda Desktop Server Path Traversal

    When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to directory traversal, which could allow a remote unauthenticated attacker to obtain f…

    PTC Axeda Desktop Server for Windows Axeda agent Windows
  • High 7.5
    CVE-2022-25250

    PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

    When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port without authentication. Successful exploitation of this vulnerability could all…

    PTC Axeda Desktop Server for Windows Axeda agent Windows
  • High 7.5
    CVE-2022-25252

    PTC Axeda agent and Axeda Desktop Server Improper Check or Handling Of Exceptional Conditions

    When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception. Services using said function do not handle the exception. Successful exploitation of this vulner…

    PTC Axeda Desktop Server for Windows Axeda agent Windows
  • Medium 5.3
    CVE-2022-25248

    PTC Axeda agent and Axeda Desktop Server Information Exposure

    When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service.

    PTC Axeda agent Axeda Desktop Server for Windows Windows

Revision history

  1. #4

    ICSA-22-067-01 PTC Axeda agent and Axeda Desktop Server (Update C)

  2. #3

    ICSA-22-067-01 PTC Axeda agent and Axeda Desktop Server (Update B)

  3. #2

    ICSA-22-067-01 PTC Axeda agent and Axeda Desktop Server (Update A)

  4. #1

    ICSA-22-067-01 PTC Axeda agent and Axeda Desktop Server

References