Seven (7) critical vulnerabilities collectively known as “Access:7” have been identified in the Parametric Technology Corporation (PTC) remote access and management agent known as Axeda, and three of these vulnerabilities have been deemed critical. The flaws could potentially affect more than 150 devices from over more than 100 manufacturers. Axeda is used in organizations to provide remote services and manage multiple IoT devices, and of the impacted devices, no less than 54% of them are within the healthcare industry. Affected devices also include ATM’s, barcode scanners, card readers, asset monitoring and tracking systems, and industrial equipment. The successful exploitation of these vulnerabilities, attackers could wreak havoc on vulnerable systems and devices, allowing attackers to perform remote code execution (RCE), pilfer sensitive data, change configurations, and ultimately crash the services running on these devices. Axeda has successfully patched all of the Access:7 vulnerabilities, and administrators and device makers should install the latest fixes immediately. This poses an obvious risk to critical infrastructure and supply chains, and although a full patch exists, these types of industries often can’t just shut down their flow of operations. Many will need to either patch their systems in sections to keep supporting their business operations, and others may have to use other more manual mitigation techniques. The specific vulnerabilities are listed in the attached article along with mitigation techniques for if the patch can’t be implemented immediately/fully. The Ankura CTIX team will continue to monitor the fallout of this matter and will be monitoring for threat actors discussing or leveraging Access:7 vulnerabilities.