What’s Vulnerable › Vulnerabilities
CVE-2023-29446: Improper Input Validation in PTC's Kepware KEPServerEX
- Severity: medium (CVSS 4.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-01-10 · updated 2026-06-17
- Weakness: CWE-40
Description
An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.
Affected products
- PTC Kepware KEPServerEX: from 6.0.2107.0 through 6.14.263.0
- PTC ThingWorx Industrial Connectivity: from 8.0 through 8.5
- PTC ThingWorx Kepware Server: from 6.8 through 6.14.263.0
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
- https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
- https://www.ptc.com/en/support/article/cs399528
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
- https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
- https://www.ptc.com/en/support/article/cs399528
Get alerted when CVE-2023-29446 or the next vulnerability affects your stack