CVE-2023-41185: Unified Automation UaGateway Certificate Parsing Integer Overflow Denial-of-Service Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-03 · updated 2026-06-17
Weakness: CWE-190

Description

Unified Automation UaGateway Certificate Parsing Integer Overflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of client certificates. When parsing the certificate length field, the process does not properly validate user-supplied data, which can result in an integer overflow. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20353.

Affected products

Unified Automation UaGateway: before 1.5.13.487 — fixed in 1.5.13.487

How to fix

Upgrade to a fixed version: Unified Automation UaGateway 1.5.13.487. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-41185 or the next vulnerability affects your stack