CVE-2020-27265: 
PTC KEPServerEX vulnerability analysis and mitigation

CVE-2020-27265 is a stack-based buffer overflow vulnerability affecting multiple industrial control system products including KEPServerEX (v6.0 to v6.9), ThingWorx Kepware Server (v6.8 and v6.9), ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server (v7.68.804 and v7.66), and Software Toolbox TOP Server (all 6.x versions). The vulnerability was discovered by Uri Katz of Claroty and reported to PTC (CISA Advisory).

The vulnerability is classified as a stack-based buffer overflow (CWE-121) with a CVSS v3 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability can be triggered by opening a specifically crafted OPC UA message, which could allow an attacker to crash the server and remotely execute code. The high CVSS score indicates that the vulnerability is exploitable remotely with low attack complexity and requires no privileges or user interaction (CISA Advisory).

Successful exploitation of this vulnerability could lead to server crashes, denial-of-service conditions, and remote code execution. The vulnerability affects critical manufacturing infrastructure sectors worldwide, potentially allowing attackers to execute code in the context of the system (CISA Advisory).

The vulnerability is remotely exploitable with low skill level required. It can be triggered by sending specifically crafted OPC UA messages to affected systems. As of the advisory date, no known public exploits specifically targeting this vulnerability were reported (CISA Advisory).

PTC and affected vendors have released updates to address this vulnerability. Users are recommended to upgrade to the latest supported versions: KEPServerEX v6.6 to 6.6.362.0, v6.7 to 6.7.1067.0, v6.8 to 6.8.838.0, and v6.9 to 6.9.584.0. Additional defensive measures include minimizing network exposure for control system devices, ensuring they are not accessible from the Internet, locating control system networks behind firewalls, and using secure methods like VPNs for remote access (CISA Advisory).