Critical Flaws in Kepware Products Can Facilitate Attacks on Industrial Firms

guest · Dec 23, 2020

Critical Flaws in Kepware Products Can Facilitate Attacks on Industrial Firms
December 23, 2020
https://www.securityweek.com/critical-flaws-kepware-products-can-facilitate-attacks-industrial-firms

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) last week published two advisories describing vulnerabilities identified in Kepware products.

One of the advisories covers three flaws discovered by researchers at industrial cybersecurity firm Claroty. The security holes, two rated critical and one high severity, are described as a stack-based buffer overflow, a heap-based buffer overflow, and a use-after-free bug.

“The vulnerabilities were located in the KEPServerEX, ThingWorx and OPC-Aggregator OPC products,” Uri Katz, senior researcher at Claroty, told SecurityWeek.
Click to expand...

The second advisory released last week by CISA describes one critical vulnerability found by a Cisco Talos researcher in Kepware LinkMaster, which is designed for exchanging data between OPC DA servers.
Talos published an advisory for this flaw on December 16, one day before CISA released its advisories.
Click to expand...

“The vulnerabilities were raised and addressed through PTC's Coordinated Vulnerability Disclosure (CVD) program - an important piece of our product security strategy.
Click to expand...

Log in or Sign up

Critical Flaws in Kepware Products Can Facilitate Attacks on Industrial Firms

guest Guest

Log in or Sign up

Critical Flaws in Kepware Products Can Facilitate Attacks on Industrial Firms

guest Guest

Useful Searches