Cyber Resilience

CVE-2023-27336

High

Published: 03 May 2024

Published
03 May 2024
Modified
13 August 2025
KEV Added
—
Patch
—
CVSS Score v3 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0029 52.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-27336 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Softing Edgeaggregator. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 47.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability. The specific flaw exists…

more

within the handling of OPC client certificates. The issue results from dereferencing a NULL pointer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20508.

CWE(s)
CWE-476

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

softing
edgeaggregator
≤ 3.70
softing
edgeconnector
≤ 3.70
softing
secure integration server
≤ 1.30

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References