CVE-2020-27267
CVE-2020-27267
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 4.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
13 Jan 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server all 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.
Affected products
n/a · GE Digital Industrial Gateway Servern/a · OPC-Aggregatorn/a · PTC Kepware KEPServerEXn/a · Rockwell Automation KEPServer Enterprisen/a · Software Toolbox TOP Servern/a · ThingWorx Industrial Connectivityn/a · ThingWorx Kepware ServerWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →