CVE-2022-2825

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-29 · updated 2026-06-17
Weakness: CWE-121

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-18411.

Affected products

GE Industrial Gateway Server: before 7.612 — fixed in 7.612
PTC Kepware KEPServerEX: before 6.12 — fixed in 6.12
PTC OPC-Aggregator: before 6.12 — fixed in 6.12
PTC ThingWorx Industrial Connectivity: all versions
PTC ThingWorx Kepware Edge: before 1.4 — fixed in 1.4
PTC ThingWorx Kepware Server: before 6.12 — fixed in 6.12
Rockwell Automation KEPServer Enterprise: before 6.12 — fixed in 6.12
Softwaretoolbox Top Server: before 6.12 — fixed in 6.12

How to fix

Upgrade to a fixed version: GE Industrial Gateway Server 7.612; PTC Kepware KEPServerEX 6.12; PTC OPC-Aggregator 6.12; PTC ThingWorx Kepware Edge 1.4; PTC ThingWorx Kepware Server 6.12; Rockwell Automation KEPServer Enterprise 6.12; Softwaretoolbox Top Server 6.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-2825 or the next vulnerability affects your stack