CVE-2020-27267
9.1
CRITICAL · CVSS 3.1 · EPSS 4.9% (pctl 92)
In your normal cycle
Critical by CVSS (9.1), but no sign of active exploitation.
Description
KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server all 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.
Scoring
| CVSS | 9.1 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| EPSS | 4.94% — more likely to be exploited than 92% of all CVEs |
| Weakness | CWE-416 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2021-01-14 |
| Last modified | 2026-06-17 |
Affected (7)
| Vendor | Product |
|---|---|
| ge | industrial gateway server |
| ptc | kepware kepserverex |
| ptc | opc-aggregator |
| ptc | thingworx industrial connectivity |
| ptc | thingworx kepware server |
| rockwellautomation | kepserver enterprise |
| softwaretoolbox | top server |
References
→ the Explorer · watch your stack · NVD