CVE-2023-29377
Quick assessment
Affected
Softing Secure Integration Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Softing OPC UA C++ SDK（版本 6.20 及更早）和 Softing Secure Integration Server（版本 1.22 及更早）中发现了一个问题。攻击者可以通过使用 FileType 重命名机制，绕过对 FileDirectory OPC UA 对象分配目录路径、以及对 File OPC UA 对象分配文件路径时的限制。
Possible ATT&CK Techniques 1 AI
T1190.001
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-29377
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
相对路径遍历
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Softing | Secure Integration Server | 0 ~ 1.22 | - |
|
II. Public POCs for CVE-2023-29377
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-29377
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-29377 (3)
IV. Related Vulnerabilities
Same product: Secure Integration Server
-
CVE-2023-39482
Softing Secure Integration Server Hardcoded Cryptographic Ke -
CVE-2023-39481
Softing Secure Integration Server Interpretation Conflict Re -
CVE-2023-39480
Softing Secure Integration Server FileDirectory OPC UA Objec -
CVE-2023-39478
Softing Secure Integration Server Exposure of Resource to Wr -
CVE-2023-39479
Softing Secure Integration Server OPC UA Gateway Directory C
Same vendor: Softing
-
CVE-2026-13148
Memory leak in scan method -
CVE-2023-7339
Data collection for dowloading leads into buffer overflow -
CVE-2024-14028
Multiple implicit reads in parallel can result in a crash or -
CVE-2025-13406
Scanning for higher HART revision device leads into NULL poi -
CVE-2025-10461
Global file reads caused by improper URL checks in webserver
V. Comments for CVE-2023-29377
No comments yet