GCVE - cpe:2.3:a:kepware:kepserverex:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:kepware:kepserverex:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Kepware (`5f0c468f-5589-5d90-9c29-aa1e60d22287`)
Product	Kepserverex (`3e76a605-aaaf-5e68-bfac-bbac1706360e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-3825`	vulnerable	2026-06-08 06:09:40.659635	Details available HIGH (7.5) PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a check to see if such an object is recursively defined, so an attack could send a maliciously created message that the decoder would try to decode until the stack overflowed and the device crashed. Published: 2023-07-31T22:53:56.568Z Updated: 2024-10-21T18:15:51.966Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-02	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-2848`	vulnerable	2026-06-08 05:43:36.609983	Details available CRITICAL (9.1) This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-16486. Published: 2023-03-29T00:00:00.000Z Updated: 2025-02-18T16:42:21.939Z Open on db.gcve.eu Reference links https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10 https://www.zerodayinitiative.com/advisories/ZDI-22-1454/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-2825`	vulnerable	2026-06-08 05:43:36.560829	Details available CRITICAL (9.8) This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-18411. Published: 2023-03-29T00:00:00.000Z Updated: 2025-02-18T16:16:11.214Z Open on db.gcve.eu Reference links https://www.zerodayinitiative.com/advisories/ZDI-22-1455/ https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2789`	vulnerable	2026-06-08 05:04:27.933878	Details available The Kepware DNP Master Driver for the KEPServerEX Communications Platform before 5.12.140.0 allows remote attackers to cause a denial of service (master-station infinite loop) via crafted DNP3 packets to TCP port 20000 and allows physically proximate attackers to cause a denial of service (master-station infinite loop) via crafted input over a serial line. Published: 2013-08-22T01:00:00.000Z Updated: 2024-09-16T18:28:46.359Z Open on db.gcve.eu Reference links http://ics-cert.us-cert.gov/advisories/ICSA-13-226-01	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.