PatchSiren cyber security CVE debrief

CVE-2024-6071 PTC CVE debrief

PTC Creo Elements/Direct License Server contains a critical unauthenticated remote code execution vulnerability. The license server's web interface allows unauthenticated remote attackers to execute arbitrary operating system commands on the server, resulting in complete system compromise. This vulnerability affects multiple products in the Creo Elements/Direct product family that rely on the affected license server component. CISA published the initial advisory on June 25, 2024, with an update on July 2, 2024 expanding the list of affected products.

Vendor: PTC
Product: Creo Elements/Direct Drafting
CVSS: CRITICAL 10
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-06-25
Original CVE updated: 2024-07-02
Advisory published: 2024-06-25
Advisory updated: 2024-07-02

Who should care

Organizations running PTC Creo Elements/Direct product suites in engineering, manufacturing, and industrial design environments. Critical infrastructure operators using these CAD/CAM/CAE tools for product development. License server administrators and OT security teams responsible for protecting engineering workstation environments.

Technical summary

The Creo Elements/Direct License Server (MEls) exposes a web management interface that fails to properly authenticate or sanitize user input, allowing unauthenticated remote attackers to inject and execute arbitrary operating system commands. The vulnerability is exploitable over the network without authentication, with low attack complexity. Successful exploitation grants attackers full control over the license server host with potential lateral movement into connected engineering workstations and product data management systems. Affected versions include Creo Elements/Direct License Server 20.7.0.0 and earlier, with the fix available in version 20.7.0.1. Multiple dependent products are affected including Drafting, Model Manager/Drawing Manager, Modeling, and WorkManager/DDM across versions 15.00 through 20.7 (20.4 for WorkManager/DDM).

Defensive priority

CRITICAL

Recommended defensive actions

Upgrade Creo Elements/Direct License Server to version 20.7.0.1 or higher immediately
Apply vendor fixes for affected Creo Elements/Direct product components
Contact PTC Technical Support for additional assistance if needed
Review PTC customer support article CS417607 for detailed guidance
Restrict network access to the license server web interface to authorized administrative hosts only
Monitor license server systems for indicators of compromise

Evidence notes

Vulnerability description and affected product versions are derived from CISA CSAF advisory ICSA-24-177-02. CVSS 3.1 score of 10.0 reflects network attack vector, low attack complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity, and availability with scope change.

Official resources

2024-06-25