« Volver al listado

CVE-2023-0754

Estado: ModificadaCrítica (9.8)—

The affected products are vulnerable to an integer overflow or wraparound, which could  allow an attacker to crash the server and remotely execute arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (9)

GE — Digital Industrial Gateway ServerPTC — Kepware ServerPTC — Kepware ServerexPTC — Thingworx .net-sdkPTC — Thingworx Edge C-sdkPTC — Thingworx Edge MicroserverPTC — Thingworx Industrial ConnectivityPTC — Thingworx Kepware EdgeRockwellautomation — Kepserver Enterprise

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-0754",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-0754",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-16T20:59:05.493845Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "PTC",
          "product": "ThingWorx Edge C-SDK",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "v2.2.12.1052 "
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Microsoft",
          "product": ".NET-SDK",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "v5.8.4.971 "
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "PTC",
          "product": "ThingWorx Edge MicroServer (EMS)",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "v5.4.10.0 "
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "PTC",
          "product": "Kepware KEPServerEX",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "v6.12 "
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "PTC",
          "product": "ThingWorx Kepware Server ",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "v6.12 "
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "PTC",
          "product": "ThingWorx Industrial Connectivity",
          "versions": [
            {
              "status": "affected",
              "version": "All Versions "
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "PTC",
          "product": "ThingWorx Kepware Edge",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "v1.5"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Rockwell Automation ",
          "product": "KEPServer Enterprise ",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "v6.12"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "General Electric ",
          "product": "Digital Industrial Gateway Server ",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "v7.612"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-02-23T22:15:11.333",
  "references": [
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nThe affected products are vulnerable to an integer\noverflow or wraparound, which could  allow an attacker to crash the server and remotely\nexecute arbitrary code.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n"
    }
  ],
  "lastModified": "2026-06-17T05:26:14.083",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ge:digital_industrial_gateway_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4D9E061-4E5C-4390-916D-8AABE3523E16",
              "versionEndIncluding": "7.612"
            },
            {
              "criteria": "cpe:2.3:a:ptc:kepware_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A50F0395-983A-4261-9FE3-40762E5EC02F",
              "versionEndIncluding": "6.12"
            },
            {
              "criteria": "cpe:2.3:a:ptc:kepware_serverex:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7C3EDBB-FEB2-4BE7-A379-AF07F1BCD46D",
              "versionEndIncluding": "6.12"
            },
            {
              "criteria": "cpe:2.3:a:ptc:thingworx_.net-sdk:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63EBD473-C1FD-4B90-BEB9-38488F6EC8A5",
              "versionEndIncluding": "5.8.4.971"
            },
            {
              "criteria": "cpe:2.3:a:ptc:thingworx_edge_c-sdk:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D82325D-070B-462B-B92F-34CC047D3340",
              "versionEndIncluding": "2.2.12.1052"
            },
            {
              "criteria": "cpe:2.3:a:ptc:thingworx_edge_microserver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E860B82D-355A-4AB3-AA93-6B1D15A1B2D7",
              "versionEndIncluding": "5.4.10.0"
            },
            {
              "criteria": "cpe:2.3:a:ptc:thingworx_industrial_connectivity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47A370A2-4847-4702-AC73-03A2B62C49C8"
            },
            {
              "criteria": "cpe:2.3:a:ptc:thingworx_kepware_edge:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C16730F8-C263-478B-B286-9831FFF5A409",
              "versionEndIncluding": "1.5"
            },
            {
              "criteria": "cpe:2.3:a:rockwellautomation:kepserver_enterprise:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5A51513-026A-43DA-9CB6-D5B68819CA47",
              "versionEndIncluding": "6.12"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}