Vulnerability · Published Mar 29, 2023 · Assigned by rapid7
CVE-2023-28501Heap buffer overflow in unirpcd
Critical 9.8
In plain English
A critical-severity integer overflow in UniData from Rocket Software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.4%top 27.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a heap-based buffer overflow in the unirpcd daemon that, if successfully exploited, can lead to remote code execution as the root user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rocket Software | UniData | 0 – before 8.2.4.3003 |
| Rocket Software | UniVerse | 0 – before 11.3.5.10010 – before 12.2.1.2002 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H