CVE-2023-41185 is an integer overflow in client certificate parsing that can crash the service, rated High (CVSS 7.5). It affects UaGateway. The fix is UaGateway 1.5.13, so update and check the vendor advisory for your build. ZDI published the report as ZDI-23-1286.
What's affected
The record lists UaGateway with no version range. ZDI says the issue was fixed in UaGateway 1.5.13 on March 20, 2023, and links a Unified Automation release note for that service release. Treat any earlier build as affected until you confirm otherwise with the vendor.
Scores disagree. The NVD record gives 7.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. ZDI, which reported the bug, scores it 8.6.
The difference comes from how each side rates attack requirements and scope. Plan against the higher of the two numbers until you have a reason not to.
How to check if you're exposed
Find every UaGateway instance in your plant or lab network and read its version. Anything below 1.5.13 should be treated as affected until the vendor says otherwise.
The record says no authentication is required and the attack is network-based, so also note which UaGateway instances accept client connections from outside a trusted segment.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It covers application dependencies, so it will not see embedded device firmware. Track devices like this in your hardware inventory instead.
What to do now
- Record the version of every UaGateway instance.
- Upgrade to UaGateway 1.5.13 or later and confirm with the Unified Automation release notes.
- Restrict which hosts can open client connections to the gateway.
- Watch the gateway for crashes or restarts, which could point to attempts against it.
Hardening steps that go beyond the advisory, such as network segmentation, are general practice and not vendor guidance for this CVE.
Why it matters
The weakness class is CWE-190: an integer overflow. The advisory says the certificate length field is not validated, which can crash the service, and no authentication is needed.
Industrial gateways often bridge plant networks and IT networks, so a crash can interrupt data flow between them.
The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read say it is exploited in the wild. That is not a reason to wait, only a note on urgency.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need an account?
No. The record says no authentication is required, and the effect is a denial of service, not code execution.
Sources
- NVD-derived record data and Safeguard Gold entry for CVE-2023-41185
- Zero Day Initiative advisory ZDI-23-1286
Last reviewed: 19 October 2026.
