CVE-2023-28503
Auth Bypass in Rocketsoftware Universe ≤ 11.3.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-28503 is a critical-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Rocketsoftware Universe. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 contain an authentication bypass vulnerability tracked as CVE-2023-28503. The flaw stems from use of hard-coded credentials combined with improper authentication handling in the UniRPC server component, allowing a specially crafted username paired with a deterministic password to evade checks entirely.
An unauthenticated attacker with network access can exploit the issue to obtain root-level command execution on the underlying operating system. The vulnerability carries a CVSS score of 9.8 and requires no user interaction or prior privileges, making remote compromise straightforward once the predictable credentials are known.
Public advisories from Rapid7 and associated exploit disclosures on Packet Storm indicate that the primary mitigation is to upgrade UniData to 8.2.4 build 3003 or later and UniVerse to 11.3.5 build 1001 or 12.2.1 build 2002 or later, which contain fixes for this and related UniRPC issues.
The current EPSS score of 0.7232 matches its observed peak, reflecting sustained exploitation interest following disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32173
Vulnerability Data
Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass…
more
authentication checks and execute OS commands as the root user.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Detects unauthorized successful logons resulting from improper authentication implementations.
Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.
Documented IA policy and procedures require proper authentication mechanisms to be defined and followed, reducing improper authentication.
Identity providers centralize and enforce authentication mechanisms, reducing improper authentication.
Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code.
Hunting detects anomalous authentication patterns or successful bypasses that allow persistent unauthorized entry.
Requiring explicit security roles and risk integration in the SDLC forces authentication mechanisms to be planned, documented, and validated instead of omitted or weakly implemented.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.AA-01's credential/key-management processes can reduce the incentive to embed secrets but do not address or detect hard-coded values in source code, so the weakness remains fully possible.
PR.AA-02 addresses human identity proofing and per-person credential issuance at enrollment; it has no bearing on whether developers embed static credentials in software.
PR.DS-01 addresses encryption and integrity of stored data but never touches credential or key management practices, so it neither prevents hard-coded credentials nor removes any of their risk.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Education on secure configuration practices discourages technical staff from embedding or relying on hard-coded credentials in systems and applications.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.