Critical RCE Vulnerability in PTC Windchill and FlexPLM

What changed

A serious vulnerability has been discovered in PTC Windchill and FlexPLM products, specifically related to improper input validation. This flaw allows for remote code execution through the deserialization of untrusted data, posing a significant risk to affected systems.

The vulnerability is applicable to all versions of PTC Windchill PDMlink and FlexPLM prior to version 11.0 M030, as well as all CPS versions.

Who is affected

Organizations utilizing PTC Windchill and FlexPLM products are at risk due to this vulnerability. Immediate attention is required to mitigate potential exploitation.

The following groups are particularly impacted:

• Users of PTC Windchill PDMlink versions prior to 11.0 M030
• Users of PTC FlexPLM versions prior to 11.0 M030
• Organizations operating on all CPS versions
• Businesses relying on PTC solutions for product lifecycle management

What to do

It is crucial for affected organizations to take immediate action to address this vulnerability. PTC recommends updating to the latest versions of Windchill and FlexPLM to mitigate the risks associated with this flaw.

Additionally, organizations should review their security protocols and ensure proper input validation measures are in place.

• Upgrade to PTC Windchill and FlexPLM version 11.0 M030 or later.
• Implement security best practices for input validation.
• Monitor systems for any unusual activity that may indicate exploitation attempts.
• Stay informed on updates from PTC regarding this vulnerability.