CVE-2023-29444: ptc kepware_kepserverex Uncontrolled Search Path Element

Vulnerability summary

CVE-2023-29444 is a high (CVSS 7.3) Uncontrolled Search Path Element vulnerability in ptc kepware_kepserverex. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.8% of scored vulnerabilities.

Timeline

1. 10-01-2024
   PublishedVulnerability first disclosed.
2. 14-05-2025
   Last modifiedVulnerability information updated.

Description

An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.