← Back

CVE-2023-5909

nvd nist
Published: Nov 30, 2023Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.

Affected (8)

Show all products
Ge: Industrial Gateway Server · Ptc: Keepserverex, Opc Aggregator, Thingworx Industrial Connectivity, Thingworx Kepware Edge, Thingworx Kepware Server · Rockwellautomation: Kepserver Enterprise · Softwaretoolbox: Top Server
Ge
1 product
Industrial Gateway Server
Ptc
5 products
Keepserverex
Opc Aggregator
Thingworx Industrial Connectivity
Thingworx Kepware Edge
Thingworx Kepware Server
Rockwellautomation
1 product
Kepserver Enterprise
Softwaretoolbox
1 product
Top Server
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Industrial Gateway Server
Up to 7.614
Keepserverex
Up to 6.14.263.0
Opc Aggregator
Up to 6.14
Thingworx Industrial Connectivity
All versions
Thingworx Kepware Edge
Up to 1.7
Thingworx Kepware Server
Up to 6.14.263.0
Kepserver Enterprise
Up to 6.14.263.0
Top Server
Up to 6.14.263.0

Related CWEs

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
CWE-297
Improper Validation of Certificate with Host Mismatch
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

References (2)

Source: ics-cert@hq.dhs.gov
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource

Timeline

No history available yet.