VulnerabilityModified
CVE-2022-25252
Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to crash the affected product.
HIGH 7.5EPSS 1.57%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.57%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception. Services using said function do not handle the exception. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to crash the affected product.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.57% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-703, CWE-754
- Affected
- ptc/axeda agent · ptc/axeda desktop server
- Source
- ics-cert@hq.dhs.gov
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01Mitigation, Third Party Advisory, US Government Resource
- https://www.ptc.com/en/support/article/CS363561Vendor Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01Mitigation, Third Party Advisory, US Government Resource
- https://www.ptc.com/en/support/article/CS363561Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.