CVE:CVE-2020-27265
CNNVD:CNNVD-202012-1305
Kepware Kepserverex是美国Kepware公司的一个可与多种工业设备进行通讯的应用软件。该软件支持150多个通讯协议，支持通过单个平台为企业提供可靠实时的数据。
多款Kepware产品存在缓冲区错误漏洞，该漏洞源于受影响的产品容易发生基于堆栈的缓冲区溢出。打开一个特别设计的OPC UA消息可能允许攻击者可利用该漏洞使服务器崩溃并远程执行代码。以下产品及版本受到影响：KEPServerEX: v6.0到v6.9，ThingWorx Kepware Server: v6.8和v6.9，ThingWorx Industrial Connectivity:所有版本，OPC-Aggregator:所有版本。
solution:Upgrade ge industrial_gateway_server to a higher version than 7.66,7.68.804,and avoid the version 7.66,7.68.804; Upgrade ptc kepware_kepserverex to a higher version than 6.0,6.9,and avoid the version 6.0,6.9; Upgrade ptc opc-aggregator to a higher version than -; Upgrade ptc thingworx_industrial_connectivity to a higher version than -; Upgrade ptc thingworx_kepware_server to a higher version than 6.8,6.9,and avoid the version 6.8,6.9; Upgrade rockwellautomation kepserver_enterprise to a higher version than 6.6.504.0,6.9.572.0,and avoid the version 6.6.504.0,6.9.572.0; Upgrade softwaretoolbox top_server to a higher version than 6.9,and avoid the version [6.0,6.9]