What’s Vulnerable › Vulnerabilities

CVE-2023-32787

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-15 · updated 2026-06-17
• Weakness: CWE-400

Description

The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications.

Affected products

• Opcfoundation Ua Java Legacy: before 2023-04-28 — fixed in 2023-04-28
• Prosysopc Ua Historian: before 1.2.0 — fixed in 1.2.0
• Prosysopc Ua Modbus Server: before 1.4.20 — fixed in 1.4.20
• Prosysopc Ua Simulation Server: before 5.4.2 — fixed in 5.4.2

How to fix

Upgrade to a fixed version: Opcfoundation Ua Java Legacy 2023-04-28; Prosysopc Ua Historian 1.2.0; Prosysopc Ua Modbus Server 1.4.20; Prosysopc Ua Simulation Server 5.4.2. Check the vendor advisory for mitigations.

References

• https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-32787.pdf
• https://github.com/OPCFoundation/UA-Java-Legacy
• https://github.com/OPCFoundation/UA-Java-Legacy/commit/6f176f2b445a27c157f1a32f225accc9ce8873c0
• https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-32787.pdf
• https://github.com/OPCFoundation/UA-Java-Legacy
• https://github.com/OPCFoundation/UA-Java-Legacy/commit/6f176f2b445a27c157f1a32f225accc9ce8873c0

Get alerted when CVE-2023-32787 or the next vulnerability affects your stack