7.3

CVE-2023-29444

An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution.

Data is provided by the National Vulnerability Database (NVD)
Ptc ≫ Kepware Kepserverex Version >= 6.0.2107.0 <= 6.14.263.0
Ptc ≫ Thingworx Kepware Server Version >= 6.8 <= 6.14.263.0
Ptc ≫ Thingworx Industrial Connectivity Version >= 8.0 <= 8.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.03% 0.071
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.3 1.3 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
ot-cert@dragos.com 6.3 0.3 5.9
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CWE-427 Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
Third Party Advisory
US Government Resource