CVE-2023-0755

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-129

Affected software

Vendor	Product	Versions
PTC	ThingWorx Edge C-SDK	<= v2.2.12.1052
Microsoft	.NET-SDK	<= v5.8.4.971
PTC	ThingWorx Edge MicroServer (EMS)	<= v5.4.10.0
PTC	Kepware KEPServerEX	<= v6.12
PTC	ThingWorx Kepware Server	<= v6.12
PTC	ThingWorx Industrial Connectivity	All Versions
PTC	ThingWorx Kepware Edge	<= v1.5
Rockwell Automation	KEPServer Enterprise	<= v6.12
General Electric	Digital Industrial Gateway Server	<= v7.612

References

https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-054-01Third Party Advisory, US Government Resource

Timeline

Published: Feb 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-07568.0An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions s CVE-2023-07579.8Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows CVE-2023-07589.8A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src CVE-2023-07598.8Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.CVE-2023-07607.8Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to V2.1.0-DEV.CVE-2023-07614.3The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which CVE-2023-07624.3The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which c CVE-2023-07634.3The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could CVE-2023-07645.4The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cr CVE-2023-07658.8The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Inject CVE-2023-07668.8The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in us CVE-2023-07678.8An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes