CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2023-5909 – Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx
https://notcve.org/view.php?id=CVE-2023-5909
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect. KEPServerEX no valida adecuadamente los certificados de los clientes, lo que puede permitir que se conecten usuarios no autenticados. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03 • CWE-295: Improper Certificate Validation CWE-297: Improper Validation of Certificate with Host Mismatch •
CVSS: 9.1EPSS: 0%CPEs: 8EXPL: 0CVE-2023-5908 – Heap Based Buffer Overflow in PTC KEPServerEx
https://notcve.org/view.php?id=CVE-2023-5908
KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information. KEPServerEX es vulnerable a un desbordamiento del búfer que puede permitir que un atacante bloquee el producto al que se accede o filtre información. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-122: Heap-based Buffer Overflow •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-0754
https://notcve.org/view.php?id=CVE-2023-0754
The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code. • https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-0755
https://notcve.org/view.php?id=CVE-2023-0755
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code. • https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01 • CWE-129: Improper Validation of Array Index •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2022-2825 – Kepware KEPServerEX Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-2825
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10 https://www.zerodayinitiative.com/advisories/ZDI-22-1455 • CWE-121: Stack-based Buffer Overflow •