CVE-2023-27336 - CVE House
Back to Database
Status published High CVE-2023-27336

Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability

Vulnerability Description

Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC client certificates. The issue results from dereferencing a NULL pointer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20508.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-27336

Credits & Attribution

No credits recorded in the NVD database.

References

More from Softing

View All →
CVE-2025-7390
Bypass the client certificate trust check of an opc.https server while only secure communication is allowed
Critical 9.1
CVE-2025-13406
Scanning for higher HART revision device leads into NULL pointer dereference in live list
Medium 6.8
CVE-2025-10685
HTTP POST with specific higher content length leads into heap corruption
High 7.7
CVE-2025-10461
Global file reads caused by improper URL checks in webserver
Medium 5.3
CVE-2024-14028
Multiple implicit reads in parallel can result in a crash or denial of service
Medium 6.5

Affected Vendor

Affected Software

edgeConnector Siemens
Vulnerable Versions:
3.40

Timeline

Official Publish: May 3rd, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-476

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1499.004 Application or System Exploitation
Impact
T1489 Service Stop
Impact
T1203 Exploitation for Client Execution
Execution
T1190 Exploit Public-Facing Application
Initial Access