Vulnerability record · CVE-2023-28503 · published 29 March 2023
CVE-2023-28503: Rocket Software UniData/UniVerse authentication bypass with hard-coded credentials
Rocketsoftware · Unidata
Rocket Software UniData and UniVerse contain an authentication bypass where a special username paired with a deterministic password defeats authentication checks. Successful exploitation allows execution of OS commands as root, making this a full compromise of the affected database server.
Description
Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication checks and execute OS commands as the root user.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication, root-level command execution and very high EPSS make this an urgent patch target.
What it is
Rocket Software UniData and UniVerse contain an authentication bypass where a special username paired with a deterministic password defeats authentication checks. Successful exploitation allows execution of OS commands as root, making this a full compromise of the affected database server.
Impact
An unauthenticated attacker gains root-level command execution on the host, leading to complete loss of confidentiality, integrity and availability of the system and any data it holds.
Attack surface
The flaw is reachable over the network via the affected service (CVSS vector AV:N) with no authentication and no user interaction required. No further detail on the specific exposed interface is given beyond the referenced udadmin_server component.
Exploitation
Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.62 (99th percentile), indicating a high likelihood of attempted exploitation; public exploit material is referenced via Packet Storm.
What to do
- Upgrade UniData to 8.2.4 build 3003 or later and UniVerse to 11.3.5 build 1001 / 12.2.1 build 2002 or later as applicable.
- Restrict network access to the affected UniRPC/udadmin_server ports to trusted hosts only.
- Run the database service under a non-root account where the product permits, to limit the impact of command execution.
- Monitor vendor advisories and Rapid7's write-up for interim workarounds if immediate patching is not possible.
Detection
- Audit authentication logs for logins using unusual or unexpected usernames, especially any matching the documented special username.
- Alert on child processes spawned by the database service, particularly shells or commands running as root.
- Monitor network connections to UniRPC/udadmin_server ports from untrusted sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-28503 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-28503), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
