CVE-2023-29445
📋 TL;DR
This CVE describes a DLL hijacking vulnerability in PTC's Kepware KEPServerEX software that allows a locally authenticated attacker to escalate privileges to SYSTEM level. The vulnerability affects industrial control systems using this OPC server software. Attackers could gain full system control on affected machines.
💻 Affected Systems
- PTC Kepware KEPServerEX
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing installation of persistent malware, data theft, and disruption of industrial operations.
Likely Case
Privilege escalation to SYSTEM by authenticated users, enabling lateral movement and persistence in industrial networks.
If Mitigated
Limited impact with proper access controls, network segmentation, and least privilege principles in place.
🎯 Exploit Status
Requires local authentication but DLL hijacking is a well-known attack vector with relatively low technical complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.14.263.0 and later
Vendor Advisory: https://www.ptc.com/en/support/article/cs399528
Restart Required: Yes
Instructions:
1. Download KEPServerEX version 6.14.263.0 or later from PTC support portal. 2. Backup configuration files. 3. Run installer with administrative privileges. 4. Restart the service/system as prompted.
🔧 Temporary Workarounds
Restrict DLL loading paths
windowsConfigure Windows DLL search order restrictions to prevent loading from untrusted directories
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name 'SafeDllSearchMode' -Value 1
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name 'CWDIllegalInDllSearch' -Value 1
Application whitelisting
windowsImplement application control policies to prevent unauthorized DLL execution
🧯 If You Can't Patch
- Implement strict access controls to limit local user access to affected systems
- Segment industrial control network from corporate network to reduce attack surface
🔍 How to Verify
Check if Vulnerable:
Check KEPServerEX version in Help > About menu or examine installed programs in Control PanelCheck Version:
wmic product where name='KEPServerEX' get versionVerify Fix Applied:
Verify version is 6.14.263.0 or higher and test DLL loading behavior📡 Detection & Monitoring
Log Indicators:
- Unexpected DLL loading from user-writable directories
- Process creation with SYSTEM privileges from non-admin users
- Windows Event ID 4688 with elevated privileges
Network Indicators:
- Unusual OPC traffic patterns
- Unexpected connections from KEPServerEX host
SIEM Query:
source="windows" (EventCode=4688 OR EventCode=4697) AND (NewProcessName="*\system32\*" OR IntegrityLevel="System") AND SubjectUserName!="SYSTEM"🔗 References
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
- https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
- https://www.ptc.com/en/support/article/cs399528
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
- https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/
- https://www.ptc.com/en/support/article/cs399528
