Vulnerability · Published Jan 13, 2021 · Assigned by icscert

CVE-2020-27263

Critical 9.1

In plain English

A critical-severity heap buffer overflow in GE Digital Industrial Gateway Server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.0% (higher than 93% of all known vulnerabilities).

Severity (CVSS NVD)9.1Critical

Exploit odds (30 days)6.0%top 6.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.

Affected products (as reported)

Vendor	Product	Versions
n/a	PTC Kepware KEPServerEX	v6.0 to v6.9
n/a	ThingWorx Kepware Server	v6.8 and v6.9
n/a	ThingWorx Industrial Connectivity	All versions
n/a	OPC-Aggregator	All versions
n/a	Rockwell Automation KEPServer Enterprise	All versions
n/a	GE Digital Industrial Gateway Server	v7.68.804v7.66
n/a	Software Toolbox TOP Server	All 6.x versions

Weakness: CWE-122

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-352-02 x_refsource_MISC