CVE-2023-32732

mediumpriority · track · 21EPSS 0.005 · 44 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.53% (44th) EPSS

CVSS 5.3 · medium

Is it mine?

32 products

Check your exposure

Who says so?

8 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309 https://www.google.com/url

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedphoenix_contact_psirt
Update to the latest 2024.0.6 LTS Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.9–7.5

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · FSTEC (BDU) RU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · cve-coordination@google.comexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · OSV

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · Phoenix Contact PSIRT DE

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-440USCWE-440USCWE-440USCWE-440USCWE-440US

affected products (32)

Products and version ranges known to be affected.

Juniper JUNOSall versionscert_bundDEcpe:/o:juniper:junos:-
Google gRPC1.53 → 1.54enisa_euvdEU
Fedora Project Fedora≤ 37fstec_bduRU
Fedora Project Fedora≤ 38fstec_bduRU
Google Inc gRPC≤ 1.53.0fstec_bduRU
Wazuh, Inc Wazuh≤ 4.4.5fstec_bduRU
business_intelligenceall versionsncsc_nlNLcpe:2.3:a:oracle:business_intelligence:7.0.0.0.0:*:*:*:enterprise:*:*:*
fedoraproject fedora= 37nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 38nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
grpc grpc< 1.53.0nvdUScpe:2.3:a:grpc:grpc:*:*:*:*:*:*:*:*
Maven io.grpc:grpc-protobuf1.53.0 → 1.53.1osvUSpkg:maven/io.grpc/grpc-protobuf
Maven io.grpc:grpc-protobuf1.54.0 → 1.54.2osvUSpkg:maven/io.grpc/grpc-protobuf
PyPI grpcio1.53.0 → 1.53.1osvUSpkg:pypi/grpcio
PyPI grpcio1.54.0 → 1.54.2osvUSpkg:pypi/grpcio
RubyGems grpc1.53.0 → 1.53.1osvUSpkg:gem/grpc
RubyGems grpc1.54.0 → 1.54.2osvUSpkg:gem/grpc
Firmware 2024.0.3 LTS installed on EPC 1502all versionsfixedphoenix_contact_psirtDE
Firmware 2024.0.3 LTS installed on EPC 1522all versionsfixedphoenix_contact_psirtDE
Firmware 2024.0.6 LTS installed on AXC F 1152all versionsfixedphoenix_contact_psirtDE
Firmware 2024.0.6 LTS installed on AXC F 2152all versionsfixedphoenix_contact_psirtDE

showing 20 of 32

advisories (5)

Vendor and ecosystem advisories describing this.

NCSC-2025-0028Kwetsbaarheden verholpen in Oracle AnalyticsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Analytics producten, zoals Business Intelligence, Analytics Desktop en BI Publisher.
VDE-2024-073Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware2024-12-09csaf · phoenix_contact_psirtDE
Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2024.0.6 LTS
WID-SEC-W-2024-1591Juniper JUNOS: Mehrere SchwachstellenDeutsch2024-07-10csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Privilegien zu erweitern und Sicherheitsmechanismen inklusive zu umgehen.
GHSA-9hxf-ppjv-w6rqgRPC connection termination issue2023-07-06ghsa · osvUS
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.
PYSEC-2026-1426gRPC connection termination issue2026-07-07vendor · osvUS
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl nvd phoenix_contact_psirt NVD CVE.org MITRE

published 2023-06-09modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan