CVE-2023-32173: uagateway (CVSS 5.8)

Description

Unified Automation UaGateway AddServer XML Injection Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the product is in its default configuration. The specific flaw exists within the implementation of the AddServer method. By specifying crafted arguments, an attacker can cause invalid characters to be inserted into an XML configuration file. An attacker can leverage this vulnerability to create a persistent denial-of-service condition on the system. . Was ZDI-CAN-20576.

Is your site exposed to CVE-2023-32173?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.8

MEDIUM

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

Weakness Type (CWE)

CWE-91 CWE-91

Affected Products

Vendor	Product	Versions
unified-automation	uagateway	< 1.5.14.495

References

Other References

https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt https://www.zerodayinitiative.com/advisories/ZDI-23-779/ https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt https://www.zerodayinitiative.com/advisories/ZDI-23-779/

Frequently Asked Questions

What is CVE-2023-32173? +

Unified Automation UaGateway AddServer XML Injection Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the product is in its default configuration. The specific flaw exists within the implementation of the AddServer method. By specifying crafted arguments, an attacker can cause invalid characters to be inserted into an XML configuration file. An attacker can leverage this vulnerability to create a persistent denial-of-service condition on the system. . Was ZDI-CAN-20576. It has a CVSS v3.1 base score of 5.8 (MEDIUM).

How severe is CVE-2023-32173? +

CVE-2023-32173 has a CVSS v3.1 score of 5.8 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2023-32173? +

CVE-2023-32173 affects products from unified-automation, specifically: uagateway. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-32173? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, …

CVE-2026-83607

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions …

CVE-2026-47080

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is associated with program files …

CVE-2026-83608

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions …

CVE-2026-41675

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to …

CVE-2025-9375

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope …

CVE-2023-32173