title: Heap Based Buffer Overflow in PTC KEPServerEx
description:
KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.
problem types: CWE-122 Heap-Based Buffer Overflow
affected:
{
defaultStatus: unaffected
product: KEPServerEX
vendor: PTC
versions:
lessThanOrEqual: 6.14.263.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ThingWorx Kepware Server
vendor: PTC
versions:
lessThanOrEqual: 6.14.263.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ThingWorx Industrial Connectivity
vendor: PTC
versions:
status: affected, version: All versions
}
{
defaultStatus: unaffected
product: OPC-Aggregator
vendor: PTC
versions:
lessThanOrEqual: 6.14, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: ThingWorx Kepware Edge
vendor: PTC
versions:
lessThanOrEqual: 1.7, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: KEPServer Enterprise
vendor: Rockwell Automation
versions:
lessThanOrEqual: 6.14.263.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Industrial Gateway Server
vendor: GE Gigital
versions:
lessThanOrEqual: 7.614, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: TOP Server
vendor: Software Toolbox
versions:
lessThanOrEqual: 6.14.263.0, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
PTC has released and recommends users to update to the following versions:
*  KEPServerEX should upgrade to v6.15 or later
*  ThingWorx Kepware Server should upgrade to v6.15 or later
*  ThingWorx Industrial Connectivity should upgrade to ThingWorx Kepware Server v6.15 or later
*  OPC-Aggregator should upgrade to v6.15 or later
*  ThingWorx Kepware Edge: Upgrade to v1.8 or later
Refer to secure configuration guide  here https://www.ptc.com/en/support/refdoc/ThingWorx_Kepware_Server/6.15/ThingWorx%20Kepware%20Server%20Secure%20Deployment%20Guide
If additional questions remain, please contact  PTC Technical Support https://support.ptc.com/apps/case_logger_viewer/cs/auth/ssl/log
For more information, see PTC's  advisory https://www.ptc.com/en/support/article/CS405439 .