PTC Creo Elements/Direct License Server (Update A)

An attacker could remotely execute arbitrary commands on your Creo Elements/Direct License Server without a password, potentially seizing control of your entire CAD system and the engineering workstations that depend on it. If your license server manages access to CAD tools for operational technology design or simulation, this could disrupt engineering workflows and compromise the integrity of design files.

Engineering and design organizations using PTC Creo Elements/Direct suite for CAD/CAM work. This includes companies in aerospace, automotive, manufacturing, and industrial design. The License Server is the central authentication point for all Creo Elements/Direct installations, making it a critical target. Compromise of the License Server could give attackers control over the entire Creo deployment and potentially access to engineering data and processes.

An attacker with network access to your License Server (typically port 7711 or similar, or through exposed web interfaces) can send a specially crafted request that bypasses authentication checks and executes OS commands. The attacker does not need valid credentials or user interaction. Once commands run on the License Server, the attacker gains the privileges of the License Server process, which could allow further lateral movement into engineering networks or CAD workstation networks.