CVE-2020-27265
published 2021-01-14CVE-2020-27265: KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell…
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
10.06%
95.0th percentile
KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions are vulnerable to a stack-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and remotely execute code.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ge | industrial_gateway_server | — | — |
| ge | industrial_gateway_server | — | — |
| ptc | kepware_kepserverex | — | — |
| ptc | kepware_kepserverex | — | — |
| ptc | thingworx_kepware_server | — | — |
| ptc | thingworx_kepware_server | — | — |
| rockwellautomation | kepserver_enterprise | — | — |
| rockwellautomation | kepserver_enterprise | — | — |
| softwaretoolbox | top_server | 6.0 – 6.9 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: opening a specifically crafted OPC UA message causes a stack-based buffer overflow, potentially crashing the server or enabling remote code execution ↗
- →Attack vector is network-accessible OPC UA service; no authentication or user interaction required (CVSS PR:N/UI:N/AV:N) — monitor OPC UA traffic for malformed/oversized messages ↗
- →Affected protocol is OPC UA; alert on unexpected server crashes or process termination of KEPServerEX / ThingWorx / TOP Server / OPC-Aggregator / Industrial Gateway Server processes following inbound OPC UA connections ↗
- ·No known public exploits exist for this vulnerability at time of advisory publication ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-355x-g6q7-4c7g: KEPServerEX: v6
ghsa_unreviewed·2022-05-24
CVE-2020-27265 [CRITICAL] CWE-787 GHSA-355x-g6q7-4c7g: KEPServerEX: v6
KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions are vulnerable to a stack-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and remotely execute code.
CISA ICS
PTC Kepware KEPServerEX (Update A)
cisa_ics·2020-12-17·CVSS 9.8
[CRITICAL] PTC Kepware KEPServerEX (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
PTC Kepware KEPServerEX (Update A)
Last RevisedJanuary 05, 2021
Alert CodeICSA-20-352-02
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: PTC
- Equipment: Kepware KEPServerEX
- Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Use After Free
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-20-352-02 PTC Kepware KEPServerEX that was published December 17, 2020, on the ICS webpage on us-cert.cisa.gov.
## 3. RISK EVALUATION
Successful exploit
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-01-14
Published