CVE-2022-25248 PTC Axeda agent and Axeda Desktop Server Information Exposure
An attacker can access sensitive event logs by connecting to a specific port on PTC Axeda agent or Desktop Server, potentially exposing system information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25248?
CVE-2022-25248 is a medium-severity vulnerability in PTC Axeda Desktop Server for Windows, published on 16 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service.
Weakness: CWE-200
Which versions are affected by CVE-2022-25248?
It affects 2 products.
Products include Ptc Axeda Agent, Ptc Axeda Desktop Server.
How do I fix CVE-2022-25248?
No fix has been published for CVE-2022-25248 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-25248 being exploited?
There is no known exploitation of CVE-2022-25248 in the wild and no public exploit code.
Other vulnerabilities in PTC Axeda Desktop Server for Windows
- CVE-2022-25246 PTC Axeda agent and Axeda Desktop Server Use of Hard-Coded Credentials
- CVE-2022-25247 PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function
- CVE-2022-25251 PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function
- CVE-2022-25249 PTC Axeda agent and Axeda Desktop Server Path Traversal
- CVE-2022-25250 PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function
Sources
Also known as GHSA-cgvq-3phw-4744.