CVE-2023-5909
Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.
- Record
CVE-2023-5909- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
EUVDEUVD-2023-58182
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.
- Record
EUVD-2023-58182- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rw69-wr48-w7px
KEPServerEX does not properly validate certificates from clients which may allow...
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.
- Record
GHSA-rw69-wr48-w7px- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-295, CWE-297
- Updated
- 2026-11-02
NVD
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.
- Record
CVE-2023-5909- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-297, CWE-295
- Updated
- 2026-11-02
Affected products
- kepware kepserverex
- ptc kepserverex
- ptc keepserverex
- ptc opc-aggregator
- ptc thingworx industrial connectivity
- ptc thingworx kepware edge
- ptc thingworx kepware server
- ge industrial gateway server
- ge gigital industrial gateway server
- rockwell automation kepserver enterprise
- rockwellautomation kepserver enterprise
- software toolbox top server
Show 1 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5909 is a high vulnerability (CVSS 7.5) in Kepware Kepserverex, published November 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. No source names a fixed version.