Unified Automation UaGateway OPC UA Server Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. User interaction is required to exploit this vulnerability in that the target must choose to accept a client certificate.
The specific flaw exists within the processing of client certificates. The issue results from the lack of proper validation of certificate data. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20494.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt | Release Notes |
| https://www.zerodayinitiative.com/advisories/ZDI-23-775/ | Third Party Advisory |
| https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt | Release Notes |
| https://www.zerodayinitiative.com/advisories/ZDI-23-775/ | Third Party Advisory |
Configurations
History
08 Aug 2025, 14:10
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Unified-automation uagateway
Unified-automation |
|
| CPE | cpe:2.3:a:unified-automation:uagateway:*:*:*:*:*:*:*:* | |
| References | () https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt - Release Notes | |
| References | () https://www.zerodayinitiative.com/advisories/ZDI-23-775/ - Third Party Advisory |
03 May 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-03 02:15
Updated : 2025-08-08 14:10
NVD link : CVE-2023-32170
Mitre link : CVE-2023-32170
JSON object : View
Products Affected
unified-automation
- uagateway
CWE
No CWE.