Trust Center PTC Advisory Center

PTC’s advisory center

Please visit the links below for information on PTC's response to vulnerabilities that have impacted PTC products and their remediation.

Advisories

PTC Kepware KEPServerEx CVD

Description: Uncontrolled Resource Consumption

Advisory ID: ICSA-23-208-02
Remediation Details

PTC Axeda agent and Axeda Desktop Server CVD

Description: Use of Hard-coded Credentials, Missing Authentication for Critical Function, Exposure of Sensitive Information to an Unauthorized Actor, Path Traversal, Improper Check or Handling of Exceptional Conditions

Advisory ID: ICSA-22-067-01
Remediation Details

TPM vulnerability impact on PTC Products

Description: These TPM Vulnerabilities have no direct impact on PTC developed products.

Advisory ID: CVE-2023-1017, CVE-2023-1018
Remediation Details

PTC ThingWorx Edge and Kepware CVD

Description: Improper Validation of Array Index, Integer Overflow or Wraparound

Advisory ID: ICSA-23-054-01
Remediation Details

Apache vulnerability impact on PTC Windchill and FlexPLM

Description:Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to.

Advisory ID: CVE-2022-36760
Remediation Details

PTC Kepware KEPServerEX (Update A) CVD

Description:Heap-based Buffer Overflow; Stack-based Buffer Overflow

Advisory ID: ICSA-22-242-10
Remediation Details

Spring4Shell vulnerability impact on PTC Windchill products

Description:A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding..

Advisory ID: CVE-2022-22965
Remediation Details

Chromium vulnerability impact on multiple PTC products

Description:Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Advisory ID: CVE-2022-1096
Remediation Details

Log4j vulnerability impact on multiple PTC products

Description:Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker-controlled LDAP and other JNDI related endpoints.