CVE-2023-52891
CVE-2023-52891 is a medium-severity vulnerability with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1325.
Key facts
- Severity: Medium (CVSS 3.x base score 5.3)
- EPSS exploit prediction: 0% (37th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2023-59603
- Weakness: CWE-1325
- Published:
- Last modified:
Description
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMIT V10 (All versions), SIMIT V11 (All versions < V11.1). Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in Siemens products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the server.
Frequently asked questions
- What is CVE-2023-52891?
- A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMIT V10 (All versions), SIMIT V11 (All versions < V11.1). Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in Siemens products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the server.
- How severe is CVE-2023-52891?
- CVE-2023-52891 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
- Is CVE-2023-52891 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2023-52891?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2023-52891 have an EU (EUVD) identifier?
- Yes. CVE-2023-52891 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-59603.
- When was CVE-2023-52891 published?
- CVE-2023-52891 was published on 2024-07-09 and last updated on 2026-06-17.
References
Other CWE-1325 vulnerabilities
- CVE-2024-27796 — High (CVSS 7.8): The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS…
- CVE-2026-34183 — High (CVSS 7.5): Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing…
- CVE-2025-2240 — High (CVSS 7.5): A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This…
- CVE-2026-8199 — Medium (CVSS 6.5): An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet,…
- CVE-2026-24819 — Medium (CVSS 6.3): Improperly Controlled Sequential Memory Allocation vulnerability in foxinmy weixin4j…
- CVE-2024-2511 — Medium (CVSS 5.9): Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3…