PT-2023-3423 · Unified Automation · Uagateway

Noam Moshe + 3 · Published 2023-05-31 · Updated 2025-08-08 · CVE-2023-32172

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Unified Automation UaGateway (affected versions not specified)

Description The issue is related to a use-after-free condition, which can be exploited by remote attackers to create a denial-of-service condition on affected installations. The specific flaw exists within the implementation of the ImportXML function, where the lack of validation of an object's existence prior to performing operations on it can be leveraged by an attacker. Authentication is required to exploit this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-03601

CVE-2023-32172

ZDI-23-777

Affected Products

Uagateway

References · 9

• https://zerodayinitiative.com/advisories/ZDI-23-777 · Security Note
• https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32172 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32172 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03601 · Security Note
• https://twitter.com/CVEnew/status/1788296004753924484 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023060105 · Note
• https://t.me/cveNotify/131410 · Telegram Post
• https://vuldb.com/?id.231897 · Note