Vulnerability Intelligence Report
PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling
CVE-2024-6098
When performing an online tag generation to devices which communicate using the ControlLogix protocol, a machine-in-the-middle, or a device that is not configured correctly, could deliver a response leading to unrestricted or unregulated resource allocation. This could cause a denial-of-service condition and crash the Kepware application. By default, these functions are turned off, yet they remain accessible for users who recognize and require their advantages.
No Active Exploit Signals
CVSS Base Score
5.3
MEDIUM
Exploitability:1.7
Impact Score:3.6
EPSS Probability:0.40%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-770 ↗CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| PTC | Kepware ThingWorx Kepware Server | V6 (affected) |
| PTC | Kepware KEPServerEX | V6 (affected) |
| Software Toolbox | TOP Server | V6 (affected) |
| GE | IGS | V7.6x (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.397%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS) · CERT · USA |
| Reserved | 2024-06-17T21:40:20 |
| Published | 2024-08-16T14:57:51 |
| Last Updated | 2024-08-19T17:32:48 |
Community Chatter & Buzz