CVE-2022-2848
Estado: ModificadaCrítica (9.1)—
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-16486.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Puntuación base: 9.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 3.37%
- Percentil entre todas las CVEs puntuadas: 88
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (8)
CWE
- CWE-122
- CWE-119
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-2848",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-2848",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-02-18T15:45:30.371828Z"
}
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 9.1,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.2,
"exploitabilityScore": 3.9
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.1,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.2,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "zdi-disclosures@trendmicro.com",
"affectedData": [
{
"vendor": "Kepware",
"product": "KEPServerEX",
"versions": [
{
"status": "affected",
"version": "6.11.718.0"
}
]
}
]
}
],
"published": "2023-03-29T19:15:11.680",
"references": [
{
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "zdi-disclosures@trendmicro.com"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1454/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "zdi-disclosures@trendmicro.com"
},
{
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1454/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"description": [
{
"lang": "en",
"value": "CWE-122"
}
]
},
{
"type": "Secondary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-16486."
}
],
"lastModified": "2026-06-17T04:42:41.850",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ge:industrial_gateway_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "864CE1B5-7A33-4BFF-955C-7ACC95670A78",
"versionEndExcluding": "7.612"
},
{
"criteria": "cpe:2.3:a:ptc:kepware_kepserverex:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F1B40A2-8747-42B6-BBBB-A7E805143FC5",
"versionEndExcluding": "6.12"
},
{
"criteria": "cpe:2.3:a:ptc:opc-aggregator:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "243853C3-04C4-4FA6-89E4-15A55D00B251",
"versionEndExcluding": "6.12"
},
{
"criteria": "cpe:2.3:a:ptc:thingworx_industrial_connectivity:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D01A814D-8F2B-4B88-A66B-F2A2C293A6AB"
},
{
"criteria": "cpe:2.3:a:ptc:thingworx_kepware_edge:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F732A00C-F341-4048-9FFD-E866A7DE50A3",
"versionEndExcluding": "1.4"
},
{
"criteria": "cpe:2.3:a:ptc:thingworx_kepware_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E4343161-DCB8-4DD3-8EA6-BC8B40FC6103",
"versionEndExcluding": "6.12"
},
{
"criteria": "cpe:2.3:a:rockwellautomation:kepserver_enterprise:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1718A22-3F3F-4523-AC36-6408929903AD",
"versionEndExcluding": "6.12"
},
{
"criteria": "cpe:2.3:a:softwaretoolbox:top_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB1AD52B-9FB3-4C97-9987-059B398A1794",
"versionEndExcluding": "6.12"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "zdi-disclosures@trendmicro.com"
}