PTC Kepware ThingWorx Kepware Server Online Tag Generation allocation of resources

Summaryinfo

A vulnerability was found in PTC Kepware ThingWorx Kepware Server. It has been classified as problematic. The impacted element is an unknown function of the component Online Tag Generation. The manipulation leads to allocation of resources. This vulnerability is listed as CVE-2024-6098. The attack must be carried out from within the local network. There is no available exploit. It is suggested to update the configuration settings.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in PTC Kepware ThingWorx Kepware Server (unknown version). This issue affects an unknown code block of the component Online Tag Generation. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is availability. The summary by CVE is:

When performing an online tag generation to devices which communicate using the ControlLogix protocol, a machine-in-the-middle, or a device that is not configured correctly, could deliver a response leading to unrestricted or unregulated resource allocation. This could cause a denial-of-service condition and crash the Kepware application. By default, these functions are turned off, yet they remain accessible for users who recognize and require their advantages.

The advisory is shared at cisa.gov. The identification of this vulnerability is CVE-2024-6098. The exploitation is known to be difficult. Access to the local network is required for this attack. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

It is possible to mitigate the problem by applying the configuration setting .

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• PTC

Name

• Kepware ThingWorx Kepware Server

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion