CVE-2023-32571
Dynamic-Linq Linq 1.0.7.10 – 1.2.25
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-32571 is a critical-severity Incorrect Comparison (CWE-697) vulnerability in Dynamic-Linq Linq. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-32571 is a remote code execution vulnerability affecting Dynamic LINQ (System.Linq.Dynamic.Core) versions 1.0.7.10 through 1.2.25 prior to 1.3.0. The flaw arises when untrusted input is supplied to methods such as Where, Select, and OrderBy, which are then parsed without sufficient validation, enabling arbitrary code and command execution. The issue carries a CVSS 3.1 base score of 9.8.
An attacker with network access can supply crafted expressions to these methods in any application that accepts dynamic LINQ queries from external sources. Successful exploitation grants full confidentiality, integrity, and availability impact without requiring authentication or user interaction.
The project repository and NCC Group advisory both point to upgrading to version 1.3.0 or later as the primary remediation, which addresses the unsafe parsing behavior.
The associated EPSS score has reached a peak of 0.8049 with a current value of 0.7691, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1897
Vulnerability Data
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle includes code review and testing that can catch incorrect comparison logic.
Application security requirements can mandate correct comparison logic for security decisions.
Secure architecture principles can require robust comparison mechanisms for access decisions.
Secure coding standards directly address avoiding incorrect comparison operators and logic.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-697, a pillar-level weakness, and none of its children carries one either.