CVE-2023-41185 Unified Automation UaGateway Certificate Parsing Integer Overflow Denial-of-Service Vulnerability
Remote attackers can cause a denial-of-service condition in Unified Automation UaGateway by exploiting an integer overflow in certificate parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41185?
CVE-2023-41185 is a high-severity vulnerability in Unified Automation UaGateway, published on 3 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unified Automation UaGateway Certificate Parsing Integer Overflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the processing of client certificates. When parsing the certificate length field, the process does not properly validate user-supplied data, which can result in an integer overflow. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20353.
Weakness: CWE-190
Which versions are affected by CVE-2023-41185?
It affects 1 product.
Products include Unified-Automation Uagateway.
How do I fix CVE-2023-41185?
No fix has been published for CVE-2023-41185 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-41185 being exploited?
There is no known exploitation of CVE-2023-41185 in the wild and no public exploit code.
Other vulnerabilities in Unified Automation UaGateway
- CVE-2023-32174 Unified Automation UaGateway NodeManagerOpcUa Use-After-Free Remote Code Execution Vulnerability
- CVE-2023-32170 Unified Automation UaGateway OPC UA Server Improper Input Validation Denial-of-Service Vulnerability
- CVE-2023-32171 Unified Automation UaGateway OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability
- CVE-2023-32172 Unified Automation UaGateway OPC UA Server Use-After-Free Denial-of-Service Vulnerability
- CVE-2023-32173 Unified Automation UaGateway AddServer XML Injection Denial-of-Service Vulnerability
Sources
Also known as GHSA-m824-jj6g-vm4f.