KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions are vulnerable to a stack-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and remotely execute code.
References
Link | Resource |
---|---|
https://us-cert.cisa.gov/ics/advisories/icsa-20-352-02 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
|
History
21 Jan 2021, 16:20
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-787 | |
CPE | cpe:2.3:a:rockwellautomation:kepserver_enterprise:6.6.504.0:*:*:*:*:*:*:* cpe:2.3:a:rockwellautomation:kepserver_enterprise:6.9.572.0:*:*:*:*:*:*:* cpe:2.3:a:ge:industrial_gateway_server:7.68.804:*:*:*:*:*:*:* cpe:2.3:a:ptc:opc-aggregator:-:*:*:*:*:*:*:* cpe:2.3:a:softwaretoolbox:top_server:*:*:*:*:*:*:*:* cpe:2.3:a:ptc:kepware_kepserverex:6.0:*:*:*:*:*:*:* cpe:2.3:a:ptc:thingworx_kepware_server:6.8:*:*:*:*:*:*:* cpe:2.3:a:ge:industrial_gateway_server:7.66:*:*:*:*:*:*:* cpe:2.3:a:ptc:thingworx_kepware_server:6.9:*:*:*:*:*:*:* cpe:2.3:a:ptc:kepware_kepserverex:6.9:*:*:*:*:*:*:* cpe:2.3:a:ptc:thingworx_industrial_connectivity:-:*:*:*:*:*:*:* |
|
References | (MISC) https://us-cert.cisa.gov/ics/advisories/icsa-20-352-02 - Third Party Advisory, US Government Resource | |
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
14 Jan 2021, 00:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-01-14 00:15
Updated : 2023-12-10 13:41
NVD link : CVE-2020-27265
Mitre link : CVE-2020-27265
CVE.ORG link : CVE-2020-27265
JSON object : View
Products Affected
softwaretoolbox
- top_server
ptc
- thingworx_industrial_connectivity
- thingworx_kepware_server
- kepware_kepserverex
- opc-aggregator
ge
- industrial_gateway_server
rockwellautomation
- kepserver_enterprise