CVE-2023-32174

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32174", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2023-05-03T20:10:47.065Z", "datePublished": "2024-05-03T01:56:50.852Z", "dateUpdated": "2024-09-18T18:28:27.941Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-09-18T18:28:27.941Z"}, "title": "Unified Automation UaGateway NodeManagerOpcUa Use-After-Free Remote Code Execution Vulnerability", "descriptions": [{"lang": "en", "value": "Unified Automation UaGateway NodeManagerOpcUa Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the product is in its default configuration.\n\nThe specific flaw exists within the handling of NodeManagerOpcUa objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.\n. Was ZDI-CAN-20577."}], "affected": [{"vendor": "Unified Automation", "product": "UaGateway", "versions": [{"version": "UaGateway 1.5.13", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-416", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-780/", "name": "ZDI-23-780", "tags": ["x_research-advisory"]}, {"url": "https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2023-05-03T20:16:43.194Z", "datePublic": "2023-05-31T23:59:29.851Z", "source": {"lang": "en", "value": "Axel '0vercl0k' Souchet of https://doar-e.github.io/"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}}]}, "adp": [{"affected": [{"vendor": "unified-automation", "product": "uagateway", "cpes": ["cpe:2.3:a:unified-automation:uagateway:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.5.14.495", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-03T17:33:02.989364Z", "id": "CVE-2023-32174", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-10T15:30:43.603Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:23.756Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-780/", "name": "ZDI-23-780", "tags": ["x_research-advisory", "x_transferred"]}, {"url": "https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt", "name": "vendor-provided URL", "tags": ["vendor-advisory", "x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-780/", "name": "ZDI-23-780", "tags": ["x_research-advisory", "x_transferred"]}, {"url": "https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt", "name": "vendor-provided URL", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:23.756Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32174", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-03T17:33:02.989364Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:unified-automation:uagateway:*:*:*:*:*:*:*:*"], "vendor": "unified-automation", "product": "uagateway", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.14.495", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-03T17:33:51.277Z"}}], "cna": {"title": "Unified Automation UaGateway NodeManagerOpcUa Use-After-Free Remote Code Execution Vulnerability", "source": {"lang": "en", "value": "Axel '0vercl0k' Souchet of https://doar-e.github.io/"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "affected": [{"vendor": "Unified Automation", "product": "UaGateway", "versions": [{"status": "affected", "version": "UaGateway 1.5.13"}], "defaultStatus": "unknown"}], "datePublic": "2023-05-31T23:59:29.851Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-780/", "name": "ZDI-23-780", "tags": ["x_research-advisory"]}, {"url": "https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2023-05-03T20:16:43.194Z", "descriptions": [{"lang": "en", "value": "Unified Automation UaGateway NodeManagerOpcUa Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the product is in its default configuration.\n\nThe specific flaw exists within the handling of NodeManagerOpcUa objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.\n. Was ZDI-CAN-20577."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-09-18T18:28:27.941Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32174", "state": "PUBLISHED", "dateUpdated": "2024-09-18T18:28:27.941Z", "dateReserved": "2023-05-03T20:10:47.065Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2024-05-03T01:56:50.852Z", "assignerShortName": "zdi"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "UaGateway", "vendor": "Unified Automation", "versions": [{"status": "affected", "version": "UaGateway 1.5.13"}]}], "source": "zdi-disclosures@trendmicro.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:unified-automation:uagateway:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "uagateway", "vendor": "unified-automation", "versions": [{"lessThan": "1.5.14.495", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:unified-automation:uagateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "80148EAB-1981-4C32-8580-19D024E5305C", "versionEndExcluding": "1.5.14.495", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unified Automation UaGateway NodeManagerOpcUa Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the product is in its default configuration.\n\nThe specific flaw exists within the handling of NodeManagerOpcUa objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.\n. Was ZDI-CAN-20577."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo de Use-After-Free de Unified Automation UaGateway NodeManagerOpcUa. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de Unified Automation UaGateway. Se requiere autenticaci\u00f3n para aprovechar esta vulnerabilidad cuando el producto est\u00e1 en su configuraci\u00f3n predeterminada. La falla espec\u00edfica existe en el manejo de objetos NodeManagerOpcUa. El problema surge de la falta de validaci\u00f3n de la existencia de un objeto antes de realizar operaciones sobre \u00e9l. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de SYSTEM. Era ZDI-CAN-20577."}], "id": "CVE-2023-32174", "lastModified": "2026-06-17T05:58:15.103", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-32174", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-05-03T17:33:02.989364Z", "version": "2.0.3"}}]}, "published": "2024-05-03T02:15:23.107", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Release Notes"], "url": "https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt"}, {"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-780/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-780/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{}