Description
An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- PTC / Kepware KEPServerEX0 – 6.14.263.0
- PTC / ThingWorx Industrial Connectivity8.0 – 8.5
- PTC / ThingWorx Kepware Server0 – 6.14.263.0
Updated 30m ago · 2 sources