CVE-2023-4785

highpriority · track · 30EPSS 0.008 · 56 %ileDEEUNLUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.77% (56th) EPSS

CVSS 7.5 · high

Is it mine?

33 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedphoenix_contact_psirt
Update to the latest 2024.0.6 LTS Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · cve-coordination@google.comexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Phoenix Contact PSIRT DE

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-248USCWE-248USCWE-248USCWE-248US

affected products (33)

Products and version ranges known to be affected.

Juniper JUNOSall versionscert_bundDEcpe:/o:juniper:junos:-
Google gRPC≤ 1.54.0 ≤1.54.2enisa_euvdEU
Google gRPC≤ 1.55.0 ≤1.55.2enisa_euvdEU
Google gRPC≤ 1.53.0 ≤1.53.1enisa_euvdEU
Google gRPC≤ 1.56.0 ≤1.56.1enisa_euvdEU
business_intelligenceall versionsncsc_nlNLcpe:2.3:a:oracle:business_intelligence:7.0.0.0.0:*:*:*:enterprise:*:*:*
grpc grpc1.23.0 → 1.53.2nvdUScpe:2.3:a:grpc:grpc:*:*:*:*:*:*:*:*
grpc grpc1.54.0 → 1.54.3nvdUScpe:2.3:a:grpc:grpc:*:*:*:*:*:*:*:*
grpc grpc1.55.0 → 1.55.3nvdUScpe:2.3:a:grpc:grpc:*:*:*:*:*:*:*:*
grpc grpc= 1.56.0nvdUScpe:2.3:a:grpc:grpc:*:*:*:*:*:*:*:*
PyPI grpcio1.53.0 → 1.53.2osvUSpkg:pypi/grpcio
PyPI grpcio1.54.0 → 1.54.3osvUSpkg:pypi/grpcio
PyPI grpcio1.55.0 → 1.55.3osvUSpkg:pypi/grpcio
RubyGems grpc1.53.0 → 1.53.2osvUSpkg:gem/grpc
RubyGems grpc1.54.0 → 1.54.3osvUSpkg:gem/grpc
RubyGems grpc1.55.0 → 1.55.3osvUSpkg:gem/grpc
RubyGems grpc1.56.0 → 1.56.2osvUSpkg:gem/grpc
Firmware 2024.0.3 LTS installed on EPC 1502all versionsfixedphoenix_contact_psirtDE
Firmware 2024.0.3 LTS installed on EPC 1522all versionsfixedphoenix_contact_psirtDE
Firmware 2024.0.6 LTS installed on AXC F 1152all versionsfixedphoenix_contact_psirtDE

showing 20 of 33

advisories (5)

Vendor and ecosystem advisories describing this.

NCSC-2025-0028Kwetsbaarheden verholpen in Oracle AnalyticsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Analytics producten, zoals Business Intelligence, Analytics Desktop en BI Publisher.
VDE-2024-073Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware2024-12-09csaf · phoenix_contact_psirtDE
Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2024.0.6 LTS
WID-SEC-W-2024-1591Juniper JUNOS: Mehrere SchwachstellenDeutsch2024-07-10csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Privilegien zu erweitern und Sicherheitsmechanismen inklusive zu umgehen.
GHSA-p25m-jpj4-qcrrDenial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)2023-09-13ghsa · osvUS
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
PYSEC-2026-1428Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)2026-07-07vendor · osvUS
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund ncsc_nl nvd phoenix_contact_psirt NVD CVE.org MITRE

published 2023-09-13modified 2026-06-17

references (21)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan