Vulnerability · Published Jul 31, 2023 · Assigned by icscert
CVE-2023-3825
High 7.5
In plain English
A high-severity uncontrolled resource consumption in KEPServerEX from PTC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Official description
PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a check to see if such an object is recursively defined, so an attack could send a maliciously created message that the decoder would try to decode until the stack overflowed and the device crashed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PTC | KEPServerEX | 6.0 – through 6.14.263 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-02 government-resource