CVE-2023-28506 - CVE House
Back to Database
Status published Unknown CVE-2023-28506

Stack buffer overflow in UniRPC service

Vulnerability Description

Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow, where a string is copied into a buffer using a memcpy-like function and a user-provided length. This requires a valid login to exploit.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-28506

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Ron Bowes

References

More from Rocket Software

View All →
CVE-2023-28509
Weak encryption in UniRPC protocol
Unknown 0
CVE-2023-28508
Heap corruption in UniRPC service
Unknown 0
CVE-2023-28507
Memory exhaustion in LZ4 decompression in UniRPC daemon
Unknown 0
CVE-2023-28505
Buffer overflow in UniRPC library function
Unknown 0
CVE-2023-28504
Stack buffer overflow in UniRPC library function
Unknown 0

Affected Vendor

Rocket Software

View all reports →

Affected Software

UniData, UniVerse
Vulnerable Versions:
0

Timeline

Official Publish: March 29th, 2023
Last Modified: February 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-120

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control