The Patching Friars' AlmanacA calendar of CVE saints

Feast day February 1

Access:7Holy card for access7, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 7 Access:7 SEPTEM CLAVES, NULLA SERA
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Access:7, of the Seven Keys

Patron of telemetry agents, networked medical devices, and vendors who thought of everything except the password.

Life

On 8 March 2022 Forescout Vedere Labs and CyberMDX revealed seven vulnerabilities in PTC's Axeda agent, the software hundreds of devices, mostly medical imaging and lab equipment, use to be managed remotely. Some let anyone who could reach the right port run code, read the whole disk or change the configuration without authenticating. Seven flaws, seven keys, one door left open.

Prayer

O Saint Access:7, who carries seven keys for the same door, let our remote agents ask who is coming in. Amen.

How to celebrate

Celebrated by updating the Axeda agent to PTC's fixed versions and discovering how many devices on the ward had it inside.

Seven keys won't help a door with no lock.

Technical record

Disclosed on
February 1 2022
CVE
CVE-2022-25247CVE-2022-25246CVE-2022-25251CVE-2022-25249CVE-2022-25250CVE-2022-25252CVE-2022-25248
CVSS
9.8
Product
PTC · Axeda agent

Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and remote code execution.

Sources: forescout.com

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.