9.8Critical

CVE-2023-0755

PTC ThingWorx Edge C-SDK; Microsoft .NET-SDK; PTC ThingWorx Edge MicroServer (EMS); PTC Kepware KEPServerEX Published: 2023-02-24 00:23 (3 years ago)

Description

The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.

Weakness (CWE): CWE-129

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
General Electric	Digital Industrial Gateway Server	≤ v7.612
Microsoft	.NET-SDK	≤ v5.8.4.971
PTC	Kepware KEPServerEX	≤ v6.12
PTC	ThingWorx Edge C-SDK	≤ v2.2.12.1052
PTC	ThingWorx Edge MicroServer (EMS)	≤ v5.4.10.0
PTC	ThingWorx Industrial Connectivity	All Versions
PTC	ThingWorx Kepware Edge	≤ v1.5
PTC	ThingWorx Kepware Server	≤ v6.12
Rockwell Automation	KEPServer Enterprise	≤ v6.12

References and patches

https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01

CVSS score

9.8Critical

Source: icscert · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (chance of exploitation in 30 days)

11.78%

higher than 96% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: total

Timeline

ID reserved2023-02-08
Published2023-02-24 00:23
Reached IP-DB2026-10-24 23:52
Last updated2025-01-17 00:55

Assigned by (CNA): icscert

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — .NET

5.3Medium

CVE-2026-120796 yesterday

.NET Denial of Service Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS; Microsoft .NET 11.0 installed on Windows; Microsoft System.Text.Json

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

1.2%EPSS

7.5High

CVE-2026-118749 yesterday

ASP.NET Core Denial of Service Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS; Microsoft .NET 11.0 installed on Windows; Microsoft Microsoft Visual Studio 2026 version 18.12

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

1.1%EPSS

7.5High

CVE-2026-118748 yesterday

ASP.NET Core Denial of Service Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS; Microsoft .NET 11.0 installed on Windows; Microsoft Microsoft Visual Studio 2026 version 18.12

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

1.1%EPSS

8.8High

CVE-2026-118745 yesterday

Visual Studio Remote Code Execution Vulnerability

Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Windows; Microsoft .NET 8.0 installed on Windows; Microsoft .NET 9.0 installed on Windows

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

6.8Medium

CVE-2026-118746 yesterday

.NET Security Feature Bypass Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS

Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.

8.8High

CVE-2026-114159 yesterday

Visual Studio Remote Code Execution Vulnerability

Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Windows; Microsoft .NET 8.0 installed on Windows; Microsoft .NET 9.0 installed on Windows

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.