Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx

Description

KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.

Scores

EPSS (exploitation in 30 days)

0.44% · top 62% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-297 Improper Validation of Certificate with Host Mismatch (opens in a new tab)All about CWE-297 and its CVEs
• CWE-295 (opens in a new tab)All about CWE-295 and its CVEs

Affected products

• PTC · KEPServerEX

  • affected ≤ 6.14.263.0

• PTC · ThingWorx Kepware Server

  • affected ≤ 6.14.263.0

• PTC · ThingWorx Industrial Connectivity

  • affected All versions

• PTC · OPC-Aggregator

  • affected ≤ 6.14

• PTC · ThingWorx Kepware Edge

  • affected ≤ 1.7

• Rockwell Automation · KEPServer Enterprise

  • affected ≤ 6.14.263.0

• GE Gigital · Industrial Gateway Server

  • affected ≤ 7.614

• Software Toolbox · TOP Server

  • affected ≤ 6.14.263.0

What to do

Solution: PTC has released and recommends users to update to the following versions: * KEPServerEX should upgrade to v6.15 or later * ThingWorx Kepware Server should upgrade to v6.15 or later * ThingWorx Industrial Connectivity should upgrade to ThingWorx Kepware Server v6.15 or later * OPC-Aggregator should upgrade to v6.15 or later * ThingWorx Kepware Edge: Upgrade to v1.8 or later Refer to secure configuration guide here https://www.ptc.com/en/support/refdoc/ThingWorx_Kepware_Server/6.15/ThingWorx%20Kepware%20Server%20Secure%20Deployment%20Guide If additional questions remain, please contact PTC Technical Support https://support.ptc.com/apps/case_logger_viewer/cs/auth/ssl/log For more information, see PTC's advisory https://www.ptc.com/en/support/article/CS405439 .

References (1)

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03 (opens in a new tab)government-resourcex_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-5909](https://trackcve.app/badge/CVE-2023-5909.svg)](https://trackcve.app/cve/CVE-2023-5909)

Record last updated 25 Feb 2026, 17:20 UTC.