CVE-2023-43775: Security issue in SMP Gateway automation platform

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-27 · updated 2026-06-17
Weakness: CWE-400

Description

Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platform, impacting the availability of the product. In rare situations, the issue could cause the SMP device to restart in Safe Mode or Max Safe Mode. When in Max Safe Mode, the product is not vulnerable anymore.

Affected products

Eaton Smp 16 Firmware: from 8.0 before 8.0r9; 6.3, 7.0, 7.1, 7.2 — fixed in 8.0r9
Eaton Smp 4/Dp Firmware: from 8.0 before 8.0r9; from 8.1 before 8.1r5; from 8.2 before 8.2r4; 6.3, 7.0, 7.1, 7.2 — fixed in 8.0r9, 8.1r5, 8.2r4
Eaton Smp Sg-4250 Firmware: from 8.0 before 8.0r9; from 8.1 before 8.1r5; from 8.2 before 8.2r4; 7.0, 7.1, 7.2 — fixed in 8.0r9, 8.1r5, 8.2r4
Eaton Smp Sg-4260 Firmware: from 8.0 before 8.0r9; from 8.1 before 8.1r5; from 8.2 before 8.2r4 — fixed in 8.0r9, 8.1r5, 8.2r4

How to fix

Upgrade to a fixed version: Eaton Smp 16 Firmware 8.0r9; Eaton Smp 4/Dp Firmware 8.0r9, 8.1r5, 8.2r4; Eaton Smp Sg-4250 Firmware 8.0r9, 8.1r5, 8.2r4; Eaton Smp Sg-4260 Firmware 8.0r9, 8.1r5, 8.2r4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-43775 or the next vulnerability affects your stack