CVE-2023-32170

CVSS V2 None CVSS V3 None

Description

Unified Automation UaGateway OPC UA Server Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. User interaction is required to exploit this vulnerability in that the target must choose to accept a client certificate. The specific flaw exists within the processing of client certificates. The issue results from the lack of proper validation of certificate data. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20494.

Overview

CVE ID
CVE-2023-32170

Assigner
zdi

Vulnerability Status
PUBLISHED

Published Version
2024-05-03T01:56:47.972Z

Last Modified Date
2024-05-03T01:56:47.972Z

Weakness Enumerations

CWE	URL
CWE-20	http://cwe.mitre.org/data/definitions/20.html

References

Reference URL	Reference Tags
https://www.zerodayinitiative.com/advisories/ZDI-23-775/	x_research-advisory
https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt	vendor-advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-32170
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32170

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 11:32:14				Added to TrackCVE