Not rated
CVE-2020-27267 KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions),…
Description
KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server all 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| PTC Kepware KEPServerEX | Versions not published | |
| ThingWorx Kepware Server | Versions not published | |
| ThingWorx Industrial Connectivity | Versions not published | |
| OPC-Aggregator | Versions not published | |
| Rockwell Automation KEPServer Enterprise | Versions not published | |
| GE Digital Industrial Gateway Server | 7.68.804 | No fix stated |
| GE Digital Industrial Gateway Server | 7.66 | No fix stated |
| Software Toolbox TOP Server | Versions not published |