Historical catalog analysis: CISA added this entry on December 03, 2024. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2023-45727 is an improper restriction of XML External Entity (XXE) reference vulnerability (CWE-611) affecting North Grid Proself. This flaw could allow a remote, unauthenticated attacker to conduct an XXE attack against the affected system.
Exposure and applicability
This vulnerability applies to several versions of the Proself product line used for remote access and management in industrial contexts, specifically:
* Proself Enterprise/Standard
* Proself Gateway
* Proself Mail Sanitize
Because these tools are often deployed to facilitate remote maintenance and monitoring of OT environments, an exposed instance could provide a point of entry for an attacker to interact with the system without requiring prior authentication.
Remediation priorities
Our analysis suggests that asset owners should prioritize the following actions based on their deployment architecture:
- Inventory and Version Verification: Identify all instances of Proself (Enterprise, Standard, Gateway, or Mail Sanitize) currently deployed within the OT environment to determine if they are running affected versions.
- Vendor Mitigation Application: Apply the mitigations provided by North Grid according to their official instructions. If mitigations are unavailable for a specific deployment, our analysis suggests evaluating whether to discontinue use of the product to eliminate the risk.
- Network Perimeter Review: Ensure that Proself instances are not unnecessarily exposed to the public internet. Restricting access to known, authorized IP addresses or requiring a VPN could reduce the likelihood of an unauthenticated remote attacker reaching the vulnerable service.
How to validate remediation
To verify that exposure has been reduced, operators should:
* Confirm through version checks and configuration audits that vendor-supplied mitigations have been successfully applied across all identified instances.
* Review firewall and access control lists (ACLs) to ensure the Proself management interface is restricted to authorized administrative networks.
Note: We do not recommend active vulnerability scanning or sending XXE payloads against production control equipment, as this may impact system stability. Validation should be performed via configuration review and OEM-approved methods.
Limits and open questions
It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, the specific operational consequences—such as the ability to pivot from the Proself gateway into deeper SCADA networks or the potential for data exfiltration—depend on the rest of the site’s network segmentation and security posture.
Source and editorial note
CVE-2023-45727: North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability · Source date: December 03, 2024 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: December 06, 2024. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 23, 2026 at 01:37 UTC.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗