CVE-2020-27263 - KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions, are vulnerable to a heap-based buffer overflow

Back Back to CVE browser

CRITICAL

KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions, are vulnerable to a heap-based buffer overflow

Published Jan 13, 2021

9.1

CRITICAL

CVSS 3.1

EPSS 4.94%

Description

KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.

Affected products

Vendor n/a Product GE Digital Industrial Gateway Server Default
n/a
- Version
  v7.66
  Status
  affected
  Constraints
  -
- Version
  v7.68.804
  Status
  affected
  Constraints
  -
Vendor n/a Product OPC-Aggregator Default
n/a
- Version
  All versions
  Status
  affected
  Constraints
  -
Vendor n/a Product PTC Kepware KEPServerEX Default
n/a
- Version
  v6.0 to v6.9
  Status
  affected
  Constraints
  -
Vendor n/a Product Rockwell Automation KEPServer Enterprise Default
n/a
- Version
  All versions
  Status
  affected
  Constraints
  -
Vendor n/a Product Software Toolbox TOP Server Default
n/a
- Version
  All 6.x versions
  Status
  affected
  Constraints
  -
Vendor n/a Product ThingWorx Industrial Connectivity Default
n/a
- Version
  All versions
  Status
  affected
  Constraints
  -
Vendor n/a Product ThingWorx Kepware Server Default
n/a
- Version
  v6.8 and v6.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

GE Digital Industrial Gateway Server

n/a

Version	Status	Constraints
v7.66	affected	-
v7.68.804	affected	-

n/a

OPC-Aggregator

n/a

Version	Status	Constraints
All versions	affected	-

n/a

PTC Kepware KEPServerEX

n/a

Version	Status	Constraints
v6.0 to v6.9	affected	-

n/a

Rockwell Automation KEPServer Enterprise

n/a

Version	Status	Constraints
All versions	affected	-

n/a

Software Toolbox TOP Server

n/a

Version	Status	Constraints
All 6.x versions	affected	-

n/a

ThingWorx Industrial Connectivity

n/a

Version	Status	Constraints
All versions	affected	-

n/a

ThingWorx Kepware Server

n/a

Version	Status	Constraints
v6.8 and v6.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-122

CWE-787

Out-of-bounds Write

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-19776
Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-352-02
x_refsource_MISCThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-19776		Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-352-02		x_refsource_MISCThird Party AdvisoryUS Government Resource