Vulnerability record · CVE-2023-28502 · published 29 March 2023
CVE-2023-28502: Rocket Software UniData/UniVerse udadmin stack buffer overflow RCE
Rocketsoftware · Unidata
Rocket Software UniData and UniVerse contain a stack-based buffer overflow in the udadmin service. A remote, unauthenticated attacker can trigger the overflow and execute code as root, making this a full-compromise flaw in the affected database products.
Description
Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the "udadmin" service that can lead to remote code execution as the root user.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and root-level code execution makes this a maximum-severity flaw.
What it is
Rocket Software UniData and UniVerse contain a stack-based buffer overflow in the udadmin service. A remote, unauthenticated attacker can trigger the overflow and execute code as root, making this a full-compromise flaw in the affected database products.
Impact
Successful exploitation gives the attacker remote code execution with root privileges on the host running the udadmin service, allowing complete control of the system and its data.
Attack surface
The flaw is reachable over the network through the udadmin service, as reflected by the CVSS vector AV:N/PR:N/UI:N. No authentication or user interaction is required to reach the vulnerable code path.
Exploitation
CVE-2023-28502 is not listed in CISA KEV, but EPSS is high at 0.611 (99th percentile), indicating elevated likelihood of exploitation activity. References include a Packet Storm advisory and a Rapid7 third-party advisory, but no public exploit tag is present in the record.
What to do
- Apply the vendor fixes: upgrade UniData to 8.2.4 build 3003 or later and UniVerse to 11.3.5 build 1001 or 12.2.1 build 2002 or later.
- Restrict network access to the udadmin service to trusted hosts only; do not expose it to untrusted networks.
- Segment affected database servers so a compromised host cannot reach broader infrastructure.
- Monitor vendor advisories for updated builds and apply them promptly.
- If patching is delayed, consider disabling or firewalling the udadmin service where operationally feasible.
Detection
- Monitor network traffic to the udadmin service port for anomalous or oversized payloads.
- Inspect host logs for unexpected process creation or crashes originating from the udadmin service.
- Watch for new or unusual outbound connections from database servers running UniData or UniVerse.
- Alert on file or configuration changes made by the udadmin service process outside normal maintenance windows.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-28502 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-28502), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
