What’s Vulnerable › Vulnerabilities

CVE-2023-23595

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-15 · updated 2026-06-17
• Weakness: CWE-611

Description

BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine example.com login daniel password qwerty" in the documentation example for the .netrc file format. NOTE: 2.x versions are no longer supported. There is no available information about whether any later version is affected.

Affected products

• Bluecatnetworks Device Registration Portal: 2.2

References

• https://bluecatnetworks.com/integrations/adaptive-application/device-registration-portal-drp/
• https://everything.curl.dev/usingcurl/netrc
• https://github.com/colemanjp/XXE-Vulnerability-in-Bluecat-Device-Registration-Portal-DRP
• https://bluecatnetworks.com/integrations/adaptive-application/device-registration-portal-drp/
• https://everything.curl.dev/usingcurl/netrc
• https://github.com/colemanjp/XXE-Vulnerability-in-Bluecat-Device-Registration-Portal-DRP

Get alerted when CVE-2023-23595 or the next vulnerability affects your stack