CVE-2023-31242

PoC ×2—

CVSS 3.1

9.8 critical

EPSS

3%p88

Published

Sep 5, 2023 (Sep 5, 2023)

Modified

Jun 17, 2026

Description

An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a sequence of requests to trigger this vulnerability.

Vendors: openautomationsoftware
Products: oas platform
Weakness: CWE-284, CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.5%)

In the news2 stories

OAS Engine Deep Dive: Abusing low-impact vulnerabilities to escalate privileges

Cisco TalosJan 31, 17:00 UTC · Jan 31, 2024Vulnerability CVE-2023-31242 CVE-2023-34998 CVE-2023-32615+2 CVEs

Eight vulnerabilities in Open Automation Software Platform could lead to information disclosure, improper authentication

Cisco TalosSep 6, 16:47 UTC · Sep 6, 2023Vulnerability CVE-2023-35124 CVE-2023-34353 CVE-2023-32271+5 CVEs