CVE-2023-37572

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-05 · updated 2026-06-17
Weakness: CWE-276

Description

Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissions in OSF_discovery service. The service executable could be changed or the service could be deleted.

Affected products

Softing Industrial Automation all versions prior to the latest build of version 4.47.0 OPC: before 5.30 — fixed in 5.30

How to fix

Upgrade to a fixed version: Softing Industrial Automation all versions prior to the latest build of version 4.47.0 OPC 5.30. Check the vendor advisory for mitigations.

References

https://industrial.softing.com/fileadmin/psirt/downloads/2023/syt-2023-5.html
https://industrial.softing.com/fileadmin/psirt/downloads/2023/syt-2023-5.html

Get alerted when CVE-2023-37572 or the next vulnerability affects your stack