CVE-2020-27267: 
PTC KEPServerEX vulnerability analysis and mitigation

CVE-2020-27267 is a use-after-free vulnerability affecting multiple industrial control system products including KEPServerEX (v6.0 to v6.9), ThingWorx Kepware Server (v6.8 and v6.9), ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server, and Software Toolbox TOP Server. The vulnerability was discovered by Uri Katz of Claroty and reported to PTC (CISA Advisory).

The vulnerability allows an attacker to create and close OPC UA connections at a high rate that may cause a server to crash. It has been assigned a CVSS v3 base score of 7.5 with the vector string (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (CISA Advisory).

Successful exploitation of this vulnerability could lead to a denial-of-service condition by causing the server to crash. The vulnerability affects critical manufacturing infrastructure sectors and is deployed worldwide (CISA Advisory).

The vulnerability is remotely exploitable with low skill level required. No known public exploits specifically targeting this vulnerability have been reported (CISA Advisory).

PTC and affected vendors have released updates to address this vulnerability. Users should upgrade to the latest supported versions: KEPServerEX users should upgrade to versions 6.6.362.0, 6.7.1067.0, 6.8.838.0, or 6.9.584.0 depending on their current version. ThingWorx Kepware Server users should upgrade to version 6.8.839.0 or 6.9.584.0. Additional defensive measures include minimizing network exposure, using firewalls, and implementing secure remote access methods like VPNs (CISA Advisory).