CVE-2023-34998

—

CVSS 3.1

8.1 high

EPSS

1%p66

Published

Sep 5, 2023 (Sep 5, 2023)

Modified

Jun 17, 2026

Description

An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary authentication. An attacker can sniff network traffic to trigger this vulnerability.

Vendors: openautomationsoftware
Products: oas platform
Weakness: CWE-319, CWE-287
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news2 stories

OAS Engine Deep Dive: Abusing low-impact vulnerabilities to escalate privileges

Cisco TalosJan 31, 17:00 UTC · Jan 31, 2024Vulnerability CVE-2023-31242 CVE-2023-34998 CVE-2023-32615+2 CVEs

Eight vulnerabilities in Open Automation Software Platform could lead to information disclosure, improper authentication

Cisco TalosSep 6, 16:47 UTC · Sep 6, 2023Vulnerability CVE-2023-35124 CVE-2023-34353 CVE-2023-32271+5 CVEs