Axeda Multiple High-Severity Vulnerabilities (CVE-2022-25246/25247) and CISA ICSA-22-067-01 Advisory

Critical Vulnerability Information Affected Products Axeda - Connectivity 6.9.4 All versions of Axeda agent All versions of Axeda Desktop Server for Windows Description CISA ICS Advisory (ICSA-22-067-01): https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01 AxedaDesktopServer.exe CVE-2022-25246 - Description: The affected product uses hardcoded credentials during UltraVNC installation. Successful exploitation could allow a remote authenticated attacker to gain complete remote control over the host operating system. - CWE: 798 Use of Hard-coded Credentials - CVSS 3.1 Score: 9.8 (Critical) CVE-2022-25250 - Description: When connected to specific ports, the affected product (all versions of Axeda agent and Axeda Desktop Server for Windows) may allow an attacker to send specific commands without authentication. Successful exploitation could result in the shutdown of specific services. - CWE: 306 Missing Authentication - CVSS 3.1 Score: 7.5 (High) ERemoteServer CVE-2022-25247 - Description: The affected product may allow an attacker to send certain commands to specific ports without authentication. Successful exploitation could allow a remote unauthenticated attacker to gain full filesystem access and remote code execution. - CWE: 306 Missing Authentication - CVSS 3.1 Score: 9.8 (Critical) CVE-2022-25248 - Description: When connected to specific ports, the affected product provides logs for specific services. - CWE: 200 Exposure of Sensitive Information - CVSS 3.1 Score: 5.3 (Medium) xGate and EKernel CVE-2022-25249 - Description: The affected product (excluding Axeda agent 6.9.2 and 6.9.3) contains a directory traversal vulnerability, which could allow a remote unauthenticated attacker to gain filesystem read access via the web server. - CWE: 22 Path Traversal - CVSS 3.1 Score: 7.5 (High) CVE-2022-25250 - Description: The affected product may allow an attacker to send specific commands to specific ports without authentication. Successful exploitation could result in the shutdown of specific services. - CWE: 306 Missing Authentication - CVSS 3.1 Score: 7.5 (High) Library module - xBase3g CVE-2022-25252 - Description: The affected product throws exceptions when receiving certain inputs. The service using this functionality does not properly handle exceptions. Successful exploitation could cause the affected product to crash remotely by an unauthenticated attacker. - CWE: 703 Improper Check or Handling of Exceptional Conditions - CVSS 3.1 Score: 7.5 (High) Notes PTC has indicated that there is no evidence that these vulnerabilities have been exploited or are currently being exploited.

Goal Reached Thanks to every supporter — we hit 100%!

Axeda Multiple High-Severity Vulnerabilities (CVE-2022-25246/25247) and CISA ICSA-22-067-01 Advisory