CVE-2023-29446

low-risk

Published 2024-01-10

An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.

Do I need to act?

0.07% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.7/10 Medium

LOCAL / HIGH complexity

Affected Products (3)

Kepware Kepserverex

Thingworx Kepware Server

Thingworx Industrial Connectivity

Affected Vendors

Ptc

References (6)

Third Party Advisory https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03

Third Party Advisory https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/

Vendor Advisory https://www.ptc.com/en/support/article/cs399528

Third Party Advisory https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03

Third Party Advisory https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/

Vendor Advisory https://www.ptc.com/en/support/article/cs399528

/ 100

low-risk

Severity 12/34 · Low

Exploitability 0/34 · Minimal

Exposure 9/34 · Low