4.7

CVE-2023-29446

An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.

Data is provided by the National Vulnerability Database (NVD)
Ptc ≫ Kepware Kepserverex Version >= 6.0.2107.0 <= 6.14.263.0
Ptc ≫ Thingworx Kepware Server Version >= 6.8 <= 6.14.263.0
Ptc ≫ Thingworx Industrial Connectivity Version >= 8.0 <= 8.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.1% 0.278
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.7 1 3.6
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
ot-cert@dragos.com 4.7 1 3.6
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-40 Path Traversal: '\\UNC\share\name\' (Windows UNC Share)

The product accepts input that identifies a Windows UNC share ('\\UNC\share\name') that potentially redirects access to an unintended location or arbitrary file.

https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
Third Party Advisory
US Government Resource