What’s Vulnerable › Vulnerabilities

CVE-2024-6071: PTC Creo Elements/Direct License Server Missing Authorization

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-27 · updated 2026-06-17
• Weakness: CWE-862

Description

PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server.

Affected products

• Creo Elements/Direct License: through 20.7.0.0

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-177-02
• https://www.ptc.com/en/support/article/CS417607
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-177-02
• https://www.ptc.com/en/support/article/CS417607

Get alerted when CVE-2024-6071 or the next vulnerability affects your stack