CVE-2023-0754: PTC ThingWorx Edge C-SDK, грешка в паметта

Описание

Оригинално описание

The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the server and remotely execute arbitrary code.

Засегнати продукти

• PTC ThingWorx Edge C-SDK: до v2.2.12.1052
• Microsoft .NET-SDK: до v5.8.4.971
• PTC ThingWorx Edge MicroServer (EMS): до v5.4.10.0
• PTC Kepware KEPServerEX: до v6.12
• PTC ThingWorx Kepware Server : до v6.12
• PTC ThingWorx Industrial Connectivity: All Versions
• PTC ThingWorx Kepware Edge: до v1.5
• Rockwell Automation KEPServer Enterprise : до v6.12
• General Electric Digital Industrial Gateway Server : до v7.612

Вид слабост

• CWE-190 Целочислено препълване отгоре

История

Други уязвимости в PTC ThingWorx Edge C-SDK

• 5.9CVE-2024-6098
• 5.7CVE-2023-29447
• 4.7CVE-2023-29446
• 7.8CVE-2023-29445
• 6.3CVE-2023-29444

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2023-0754
• https://nvd.nist.gov/vuln/detail/CVE-2023-0754
• https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01