CVE-2020-27267 Memory corruption in GE Digital Industrial Gateway Server

Critical 9.1 Published 13 Jan 2021 Updated 4 Aug 2024

Attackers can crash the server and potentially leak data by sending a crafted OPC UA message to vulnerable industrial connectivity products.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-27267?

CVE-2020-27267 is a critical memory corruption vulnerability in GE Digital Industrial Gateway Server, published on 13 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server all 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.

Weakness: CWE-787, CWE-416

Which versions are affected by CVE-2020-27267?

It affects 7 products.

Products include Ge Industrial Gateway Server, Ptc Kepware Kepserverex, Ptc Opc-Aggregator, Ptc Thingworx Industrial Connectivity, Ptc Thingworx Kepware Server, Rockwellautomation Kepserver Enterprise and 1 more.

How do I fix CVE-2020-27267?

No fix has been published for CVE-2020-27267 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-27267 being exploited?

There is no known exploitation of CVE-2020-27267 in the wild and no public exploit code.

Sources

Also known as GHSA-mr5h-jvqg-8jg8.