Vulnerability · Published Feb 23, 2023 · Assigned by icscert
CVE-2023-0754
Critical 9.8
In plain English
A critical-severity integer overflow in Digital Industrial Gateway Server from General Electric . There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.9%top 12.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PTC | ThingWorx Edge C-SDK | 0 – through v2.2.12.1052 |
| Microsoft | .NET-SDK | 0 – through v5.8.4.971 |
| PTC | ThingWorx Edge MicroServer (EMS) | 0 – through v5.4.10.0 |
| PTC | Kepware KEPServerEX | 0 – through v6.12 |
| PTC | ThingWorx Kepware Server | 0 – through v6.12 |
| PTC | ThingWorx Industrial Connectivity | All Versions |
| PTC | ThingWorx Kepware Edge | 0 – through v1.5 |
| Rockwell Automation | KEPServer Enterprise | 0 – through v6.12 |
| General Electric | Digital Industrial Gateway Server | 0 – through v7.612 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H