Vulnerability · Published Mar 16, 2022 · Assigned by icscert

CVE-2022-25251PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

Critical 9.8

In plain English

A critical-severity missing authentication in Axeda agent from PTC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.9%top 20.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific port without proper authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to read and modify the affected product’s configuration.

Affected products (as reported)

Vendor	Product	Versions
PTC	Axeda agent	All Versions
PTC	Axeda Desktop Server for Windows	All Versions

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01 x_refsource_MISC
https://www.ptc.com/en/support/article/CS363561 x_refsource_MISC