CVE-2023-38534 is a high severity (CVSS 8.6) improper authentication flaw in OpenText Exceed TurboX versions 12.5.0 and 12.5.1 that could disclose restricted information through an unauthenticated RPC. I could not load the OpenText article, so read it for the fixed version.
What's affected
The affected product is OpenText Exceed TurboX, versions 12.5.0 and 12.5.1. The record says the improper authentication could allow disclosure of restricted information in an unauthenticated RPC. The record is dated 2024-03-13 and scores 8.6, High, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N: network reachable, no privileges, no interaction, a changed scope and a high confidentiality impact.
The record references OpenText knowledge base article KB0796609. That page needs a script-capable browser, so I could not read it and cannot confirm a fixed version. Do not assume a fix number from this post. Open the article, or ask OpenText support, for the corrected release and any interim steps.
Weakness class: CWE-287.
How to check if you're exposed
Open the Exceed TurboX management console or the server's version information and note the installed version. Versions 12.5.0 and 12.5.1 are named in the record.
Then identify which network segments can reach the TurboX server's RPC service. The exposure is to unauthenticated callers, so reachability decides the risk. Ask your network team for the firewall rules that apply to the server.
What to do now
- Locate every Exceed TurboX server and record its version.
- Open OpenText KB0796609 and follow the remediation it lists.
- Restrict network access to the server's RPC service to the clients that need it.
- Place the server behind a VPN or gateway if it is currently exposed to wider networks.
- Review server logs for unexpected calls from addresses you do not recognise.
Why it matters
The weakness is improper authentication on a remote procedure call. The service answers a call without checking who is asking, and the answer contains information meant to be restricted. The scope in the vector is Changed, which means the information can affect resources beyond the TurboX component itself.
Remote desktop and application delivery servers often hold names, hosts and session details. Even without code execution, that information helps an attacker plan their next step. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not report exploitation.
Improper authentication means the product accepts a claim of identity without adequately proving it, or accepts a credential or token that it should not trust. Tokens and keys should be treated as secrets, scoped to the least access needed, and revocable.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
What version fixes it?
I could not confirm this. The record points to OpenText article KB0796609, which you should read.
What is the quickest risk reduction?
Limit which networks can reach the server's RPC service until you have patched.
Sources
Last reviewed: 19 October 2026.
