Vulnerability · Published Mar 16, 2022 · Assigned by icscert
CVE-2022-25247PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function
Critical 9.8
In plain English
A critical-severity missing authentication in Axeda agent from PTC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)4.1%top 9.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PTC | Axeda agent | All Versions |
| PTC | Axeda Desktop Server for Windows | All Versions |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01 x_refsource_MISC
- https://www.ptc.com/en/support/article/CS363561 x_refsource_MISC