Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2023-29447

Summary
Assigner-Dragos
Assigner Org ID-12bdf821-1545-4a87-aac5-61670cc6fcef
Published At-10 Jan, 2024 | 20:24
Updated At-17 Jun, 2025 | 20:59
Rejected At-
Credits

Insufficiently Protected Credentials in PTC's Kepware KEPServerEX

An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:Dragos
Assigner Org ID:12bdf821-1545-4a87-aac5-61670cc6fcef
Published At:10 Jan, 2024 | 20:24
Updated At:17 Jun, 2025 | 20:59
Rejected At:
▼CVE Numbering Authority (CNA)
Insufficiently Protected Credentials in PTC's Kepware KEPServerEX

An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.

Affected Products
Vendor
PTC
Product
Kepware KEPServerEX
Platforms
  • Windows
Default Status
unaffected
Versions
Affected
  • From 0 through 6.14.263.0 (0)
Vendor
PTC
Product
ThingWorx Kepware Server
Platforms
  • Windows
Default Status
unaffected
Versions
Affected
  • From 0 through 6.14.263.0 (0)
Vendor
PTC
Product
ThingWorx Industrial Connectivity
Platforms
  • Windows
Default Status
unaffected
Versions
Affected
  • From 8.0 through 8.5 (0)
Problem Types
TypeCWE IDDescription
CWECWE-522CWE-522 Insufficiently Protected Credentials
Type: CWE
CWE ID: CWE-522
Description: CWE-522 Insufficiently Protected Credentials
Metrics
VersionBase scoreBase severityVector
3.15.7MEDIUM
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Version: 3.1
Base score: 5.7
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-94CAPEC-94 Man in the Middle Attack
CAPEC ID: CAPEC-94
Description: CAPEC-94 Man in the Middle Attack
Solutions
Configurations
Workarounds
Exploits
Credits
finder
Sam Hanson of Dragos
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
government-resource
https://www.ptc.com/en/support/article/cs399528
vendor-advisory
https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
N/A
Hyperlink: https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
Resource:
government-resource
Hyperlink: https://www.ptc.com/en/support/article/cs399528
Resource:
vendor-advisory
Hyperlink: https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
Resource: N/A
▼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
government-resource
x_transferred
https://www.ptc.com/en/support/article/cs399528
vendor-advisory
x_transferred
https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
x_transferred
Hyperlink: https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
Resource:
government-resource
x_transferred
Hyperlink: https://www.ptc.com/en/support/article/cs399528
Resource:
vendor-advisory
x_transferred
Hyperlink: https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
Resource:
x_transferred
2. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:ot-cert@dragos.com
Published At:10 Jan, 2024 | 21:15
Updated At:18 Jan, 2024 | 19:53

An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.15.3MEDIUM
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Secondary3.15.7MEDIUM
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Type: Primary
Version: 3.1
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Type: Secondary
Version: 3.1
Base score: 5.7
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CPE Matches
ptc
ptc
>>kepware_kepserverex>>Versions from 6.0.2107.0(inclusive) to 6.14.263.0(inclusive)
cpe:2.3:a:ptc:kepware_kepserverex:*:*:*:*:*:*:*:*
ptc
ptc
>>thingworx_kepware_server>>Versions from 6.8(inclusive) to 6.14.263.0(inclusive)
cpe:2.3:a:ptc:thingworx_kepware_server:*:*:*:*:*:*:*:*
ptc
ptc
>>thingworx_industrial_connectivity>>Versions from 8.0(inclusive) to 8.5(inclusive)
cpe:2.3:a:ptc:thingworx_industrial_connectivity:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-522Primarynvd@nist.gov
CWE-522Secondaryot-cert@dragos.com
CWE ID: CWE-522
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-522
Type: Secondary
Source: ot-cert@dragos.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03ot-cert@dragos.com
Third Party Advisory
US Government Resource
https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/ot-cert@dragos.com
Third Party Advisory
https://www.ptc.com/en/support/article/cs399528ot-cert@dragos.com
Vendor Advisory
Hyperlink: https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
Source: ot-cert@dragos.com
Resource:
Third Party Advisory
US Government Resource
Hyperlink: https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
Source: ot-cert@dragos.com
Resource:
Third Party Advisory
Hyperlink: https://www.ptc.com/en/support/article/cs399528
Source: ot-cert@dragos.com
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

4Records found
CVE-2023-29168
Matching Score-6
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-6
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-3.7||LOW
EPSS-0.07% / 22.99%
||
7 Day CHG~0.00%
Published-07 Jun, 2023 | 21:42
Updated-06 Jan, 2025 | 19:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
PTC Vuforia Studio Insufficiently Protected Credentials

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.

Action-Not Available
Vendor-ptcPTC
Product-vuforia_studioVuforia Studio
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2024-37187
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-6.8||MEDIUM
EPSS-0.02% / 4.26%
||
7 Day CHG~0.00%
Published-27 Sep, 2024 | 17:25
Updated-07 Oct, 2024 | 15:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Advantech ADAM-5550 Weak Encoding for Password

Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding.

Action-Not Available
Vendor-Advantech (Advantech Co., Ltd.)
Product-adam-5550adam-5550_firmwareADAM 5550
CWE ID-CWE-261
Weak Encoding for Password
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2024-34542
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-6.9||MEDIUM
EPSS-0.04% / 8.69%
||
7 Day CHG~0.00%
Published-27 Sep, 2024 | 17:45
Updated-07 Oct, 2024 | 15:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Advantech ADAM-5630 Weak Encoding for Password

Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process.

Action-Not Available
Vendor-Advantech (Advantech Co., Ltd.)
Product-adam-5630_firmwareadam-5630ADAM-5630
CWE ID-CWE-261
Weak Encoding for Password
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-27270
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-5.7||MEDIUM
EPSS-0.05% / 14.16%
||
7 Day CHG~0.00%
Published-19 Jan, 2021 | 16:17
Updated-04 Aug, 2024 | 16:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDana-A mobile apps doesnt use adequate measures to protect encryption keys in transit which allows unauthenticated physically proximate attacker to sniff keys via (BLE).

Action-Not Available
Vendor-sooiln/a
Product-anydana-i_firmwareanydana-ianydana-adiabecare_rsanydana-a_firmwarediabecare_rs_firmwareSOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A
CWE ID-CWE-522
Insufficiently Protected Credentials
Details not found