Vulnerability Intelligence Report
Uncontrolled Search Path Element in PTC's Kepware KEPServerEX
CVE-2023-29444
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution.
No Active Exploit Signals
CVSS Base Score
6.3
MEDIUM
Exploitability:0.4
Impact Score:5.9
EPSS Probability:0.17%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-427 ↗CWE-427 Uncontrolled Search Path Element
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| PTC | Kepware KEPServerEX | 0 <= 6.14.263.0 (affected) |
| PTC | ThingWorx Kepware Server | 0 <= 6.14.263.0 (affected) |
| PTC | ThingWorx Industrial Connectivity | 8.0 <= 8.5 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.171%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Dragos, Inc. · Vendor · USA |
| Reserved | 2023-04-06T17:45:40 |
| Published | 2024-01-10T17:06:35 |
| Last Updated | 2025-05-14T20:14:19 |
Community Chatter & Buzz