Stack-based buffer overflow in Kepware KEPServerEX
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-18411.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kepware | KEPServerEX | 6.11.718.0 | — | No fix listed | CNA |
- KEPServerEX VendorKepware Affected 6.11.718.0 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ge:industrial_gateway_server:*:*:*:*:*:*:*:* | before 7.612 | Vulnerable | GE |
| cpe:2.3:a:ptc:kepware_kepserverex:*:*:*:*:*:*:*:* | before 6.12 | Vulnerable | PTC |
| cpe:2.3:a:ptc:opc-aggregator:*:*:*:*:*:*:*:* | before 6.12 | Vulnerable | PTC |
| cpe:2.3:a:ptc:thingworx_industrial_connectivity:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | PTC |
| cpe:2.3:a:ptc:thingworx_kepware_edge:*:*:*:*:*:*:*:* | before 1.4 | Vulnerable | PTC |
| cpe:2.3:a:ptc:thingworx_kepware_server:*:*:*:*:*:*:*:* | before 6.12 | Vulnerable | PTC |
| cpe:2.3:a:rockwellautomation:kepserver_enterprise:*:*:*:*:*:*:*:* | before 6.12 | Vulnerable | Rockwell |
| cpe:2.3:a:softwaretoolbox:top_server:*:*:*:*:*:*:*:* | before 6.12 | Vulnerable | Software Toolbox |
- cpe:2.3:a:ge:industrial_gateway_server:*:*:*:*:*:*:*:* Versions before 7.612 Vulnerable ·GE
- cpe:2.3:a:ptc:kepware_kepserverex:*:*:*:*:*:*:*:* Versions before 6.12 Vulnerable ·PTC
- cpe:2.3:a:ptc:opc-aggregator:*:*:*:*:*:*:*:* Versions before 6.12 Vulnerable ·PTC
- cpe:2.3:a:ptc:thingworx_industrial_connectivity:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·PTC
- cpe:2.3:a:ptc:thingworx_kepware_edge:*:*:*:*:*:*:*:* Versions before 1.4 Vulnerable ·PTC
- cpe:2.3:a:ptc:thingworx_kepware_server:*:*:*:*:*:*:*:* Versions before 6.12 Vulnerable ·PTC
- cpe:2.3:a:rockwellautomation:kepserver_enterprise:*:*:*:*:*:*:*:* Versions before 6.12 Vulnerable ·Rockwell
- cpe:2.3:a:softwaretoolbox:top_server:*:*:*:*:*:*:*:* Versions before 6.12 Vulnerable ·Software Toolbox
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2825
- 2026-10-03 Alias added: GHSA-6rww-x4m5-6j62
References
More Kepware vulnerabilities
- TI-2022-02641 Heap-based buffer overflow in Kepware KEPServerEX CVSS 3.1CRITICAL 9.1
- TI-2013-02437 The Kepware DNP Master Driver for the KEPServerEX Communications Platform before… CVSS 2.0HIGH 7.8
- TI-2020-10614 Incorrect default permissions in Kepware CVSS 3.1HIGH 7.8
- TI-2023-03574 Uncontrolled resource consumption in PTC KEPServerEX CVSS 3.1HIGH 7.5
Sources
- CVE-2022-2825 · CVE Program
- CVE-2022-2825 · NVD
- FIRST EPSS
- GHSA-6rww-x4m5-6j62 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences