Read the docs
TI-2023-05440 Aliases CVE-2023-5908GHSA-m695-35xv-pjcm

Heap Based Buffer Overflow in PTC KEPServerEx

Priority MEDIUM 41CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.

Why it matters now

EPSS 0.00962 61st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PTCKEPServerEXup to 6.14.263.0—No fix listedCNA
PTCThingWorx Kepware Serverup to 6.14.263.0—No fix listedCNA
PTCThingWorx Industrial ConnectivityAll versions—No fix listedCNA
PTCOPC-Aggregatorup to 6.14—No fix listedCNA
PTCThingWorx Kepware Edgeup to 1.7—No fix listedCNA
RockwellKEPServer Enterpriseup to 6.14.263.0—No fix listedCNA
GE GigitalIndustrial Gateway Serverup to 7.614—No fix listedCNA
Software ToolboxTOP Serverup to 6.14.263.0—No fix listedCNA
  • KEPServerEX VendorPTC Affected up to 6.14.263.0 Fixed in — No fix listed CNA
  • ThingWorx Kepware Server VendorPTC Affected up to 6.14.263.0 Fixed in — No fix listed CNA
  • ThingWorx Industrial Connectivity VendorPTC Affected All versions Fixed in — No fix listed CNA
  • OPC-Aggregator VendorPTC Affected up to 6.14 Fixed in — No fix listed CNA
  • ThingWorx Kepware Edge VendorPTC Affected up to 1.7 Fixed in — No fix listed CNA
  • KEPServer Enterprise VendorRockwell Affected up to 6.14.263.0 Fixed in — No fix listed CNA
  • Industrial Gateway Server VendorGE Gigital Affected up to 7.614 Fixed in — No fix listed CNA
  • TOP Server VendorSoftware Toolbox Affected up to 6.14.263.0 Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:ge:industrial_gateway_server:*:*:*:*:*:*:*:*up to 7.614VulnerableGE
cpe:2.3:a:ptc:keepserverex:*:*:*:*:*:*:*:*up to 6.14.263.0VulnerablePTC
cpe:2.3:a:ptc:opc-aggregator:*:*:*:*:*:*:*:*up to 6.14VulnerablePTC
cpe:2.3:a:ptc:thingworx_industrial_connectivity:-:*:*:*:*:*:*:*not specified by NVDVulnerablePTC
cpe:2.3:a:ptc:thingworx_kepware_edge:*:*:*:*:*:*:*:*up to 1.7VulnerablePTC
cpe:2.3:a:ptc:thingworx_kepware_server:*:*:*:*:*:*:*:*up to 6.14.263.0VulnerablePTC
cpe:2.3:a:rockwellautomation:kepserver_enterprise:*:*:*:*:*:*:*:*up to 6.14.263.0VulnerableRockwell
cpe:2.3:a:softwaretoolbox:top_server:*:*:*:*:*:*:*:*up to 6.14.263.0VulnerableSoftware Toolbox
  • cpe:2.3:a:ge:industrial_gateway_server:*:*:*:*:*:*:*:* Versions up to 7.614 Vulnerable ·GE
  • cpe:2.3:a:ptc:keepserverex:*:*:*:*:*:*:*:* Versions up to 6.14.263.0 Vulnerable ·PTC
  • cpe:2.3:a:ptc:opc-aggregator:*:*:*:*:*:*:*:* Versions up to 6.14 Vulnerable ·PTC
  • cpe:2.3:a:ptc:thingworx_industrial_connectivity:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·PTC
  • cpe:2.3:a:ptc:thingworx_kepware_edge:*:*:*:*:*:*:*:* Versions up to 1.7 Vulnerable ·PTC
  • cpe:2.3:a:ptc:thingworx_kepware_server:*:*:*:*:*:*:*:* Versions up to 6.14.263.0 Vulnerable ·PTC
  • cpe:2.3:a:rockwellautomation:kepserver_enterprise:*:*:*:*:*:*:*:* Versions up to 6.14.263.0 Vulnerable ·Rockwell
  • cpe:2.3:a:softwaretoolbox:top_server:*:*:*:*:*:*:*:* Versions up to 6.14.263.0 Vulnerable ·Software Toolbox

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5908
  2. 2026-10-03 Alias added: GHSA-m695-35xv-pjcm

References

Advisory 1

  • TI-2023-05441 Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences