Vulnerability · Published Feb 23, 2023 · Assigned by icscert
CVE-2023-0755
Critical 9.8
In plain English
A critical-severity security flaw in Digital Industrial Gateway Server from General Electric . There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.8% (higher than 96% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)11.8%top 3.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PTC | ThingWorx Edge C-SDK | 0 – through v2.2.12.1052 |
| Microsoft | .NET-SDK | 0 – through v5.8.4.971 |
| PTC | ThingWorx Edge MicroServer (EMS) | 0 – through v5.4.10.0 |
| PTC | Kepware KEPServerEX | 0 – through v6.12 |
| PTC | ThingWorx Kepware Server | 0 – through v6.12 |
| PTC | ThingWorx Industrial Connectivity | All Versions |
| PTC | ThingWorx Kepware Edge | 0 – through v1.5 |
| Rockwell Automation | KEPServer Enterprise | 0 – through v6.12 |
| General Electric | Digital Industrial Gateway Server | 0 – through v7.612 |
Weakness: CWE-129 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H