CVE-2023-32174

The vulnerability results from lack of verification of the existence of the NodeManagerOpcUa object before performing operations on this object, which leads to a classic use-after-free error. An attacker can craft an appropriate request that references an already freed memory area. In the default configuration of the product, authentication is required to exploit the vulnerability. Successful exploitation of the error allows an attacker to take control of the program execution flow and execute malicious code.

An attacker can execute arbitrary code in the context of the SYSTEM account, which means complete takeover of the compromised system, including the ability to install malicious software, steal data, and perform lateral movement in the network.

Update Unified Automation UaGateway to version 1.5.14 or newer according to the information in the vendor documentation (https://documentation.unified-automation.com/uagateway/1.5.14/CHANGELOG.txt). As an additional measure, it is recommended to restrict network access to the OPC UA interface exclusively to trusted hosts.

Unified Automation UaGateway — versions indicated in the vendor references (changelog available for version 1.5.14 indicates the patched release)