PT-2023-23646 · Unified Automation · Uagateway

0Vercl0K + 1 · Publicado 2023-05-31 · Atualizado 2025-08-08 · CVE-2023-32173

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Unified Automation UaGateway (affected versions not specified)

Description This issue allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. The flaw exists within the implementation of the AddServer method, where specifying crafted arguments can cause invalid characters to be inserted into an XML configuration file, leading to a persistent denial-of-service condition. Authentication is required to exploit this vulnerability when the product is in its default configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-91

Identificadores relacionados

CVE-2023-32173

ZDI-23-779

Produtos afetados

Uagateway

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-32173 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-23-779 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-32173 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1788296003646627865 · Publicação no Twitter
• https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt · Aviso do Fabricante
• https://t.me/cveNotify/131411 · Publicação no Telegram