Description
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PTC | ThingWorx Edge C-SDK | ≤ v2.2.12.1052 | — |
| Microsoft | .NET-SDK | ≤ v5.8.4.971 | — |
| PTC | ThingWorx Edge MicroServer (EMS) | ≤ v5.4.10.0 | — |
| PTC | Kepware KEPServerEX | ≤ v6.12 | — |
| PTC | ThingWorx Kepware Server | ≤ v6.12 | — |
| PTC | ThingWorx Industrial Connectivity | All Versions | — |
| PTC | ThingWorx Kepware Edge | ≤ v1.5 | — |
| Rockwell Automation | KEPServer Enterprise | ≤ v6.12 | — |
| General Electric | Digital Industrial Gateway Server | ≤ v7.612 | — |
Advisories 1
- ICSA-23-054-01 PTC ThingWorx Edge CISA ICS & IT advisories · Feb 27, 2023