Vulnerability Details : CVE-2023-32173
Unified Automation UaGateway AddServer XML Injection Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the product is in its default configuration.
The specific flaw exists within the implementation of the AddServer method. By specifying crafted arguments, an attacker can cause invalid characters to be inserted into an XML configuration file. An attacker can leverage this vulnerability to create a persistent denial-of-service condition on the system.
. Was ZDI-CAN-20576.
Vulnerability category: Denial of service
Products affected by CVE-2023-32173
Please log in to view affected product information.
Exploit prediction scoring system (EPSS) score for CVE-2023-32173
1.36%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 79 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-32173
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.8
|
MEDIUM | CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H |
1.3
|
4.0
|
Zero Day Initiative | 2024-05-03 |
CWE ids for CVE-2023-32173
-
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.Assigned by: zdi-disclosures@trendmicro.com (Secondary)
References for CVE-2023-32173
-
https://www.zerodayinitiative.com/advisories/ZDI-23-779/
ZDI-23-779 | Zero Day Initiative
-
https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt
Jump to