CVE-2023-29444

MEDIUM

PTC Kepware Kepserverex < 6.14.263.0 - Uncontrolled Search Path

Title source: rule

Description

An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution.

References (2)

Core 2

Core References

Third Party Advisory, US Government Resource government-resource

https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03

Vendor Advisory vendor-advisory

https://www.ptc.com/en/support/article/cs399528

Scores

CVSS v3 6.3

EPSS 0.0017

EPSS Percentile 6.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-427

Status published

Products (3)

ptc/kepware_kepserverex 6.0.2107.0 - 6.14.263.0

ptc/thingworx_industrial_connectivity 8.0 - 8.5

ptc/thingworx_kepware_server 6.8 - 6.14.263.0

Published Jan 10, 2024

Tracked Since Feb 18, 2026