PT-2023-23646 · Unified Automation · Uagateway

0Vercl0K + 1 · Published 2023-05-31 · Updated 2025-08-08 · CVE-2023-32173

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Unified Automation UaGateway (affected versions not specified)

Description This issue allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. The flaw exists within the implementation of the AddServer method, where specifying crafted arguments can cause invalid characters to be inserted into an XML configuration file, leading to a persistent denial-of-service condition. Authentication is required to exploit this vulnerability when the product is in its default configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2023-32173

ZDI-23-779

Affected Products

Uagateway

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-32173 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-779 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32173 · Vendor Advisory
• https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt · Vendor Advisory
• https://twitter.com/CVEnew/status/1788296003646627865 · Twitter Post
• https://t.me/cveNotify/131411 · Telegram Post