Who should care
Anyone who runs a website or service that speaks HTTP/2, directly or through a content delivery network, load balancer or reverse proxy. Most small businesses depend on a host or provider for this, so ask them.
What to do
- Ask your hosting provider or content delivery network whether they have applied the vendor's mitigations for CVE-2023-44487.
- If you run your own web server or proxy, read its vendor advisory and apply mitigations, as the CISA catalogue sample says.
- Keep the web server, proxy and load balancer software up to date.
- Run the exposure check on this page again once you have updated.
What is affected
The flaw is in how servers handle the HTTP/2 protocol, so it can affect many web servers, proxies and load balancers. Our offline sample does not list products or versions. Check each vendor's advisory.
Is it being exploited?
- CISA KEV
- Listed in the CISA Known Exploited Vulnerabilities (KEV) catalogue, which means CISA has evidence it has been exploited. It was added on 10 October 2023. CISA's due date for United States federal agencies to act was 31 October 2023.
- EPSS
- Not in our offline sample: check the CISA catalogue.
Severity and technical details
- CVSS score
- 7.5 out of 10, high (CVSS version 3.1)
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
- Affected version ranges
- siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp firmware from 3.1.5
- siemens sinec ins up to (excluding) 1.0
- siemens sinec ins 1.0
- siemens sinec nms up to (excluding) 3.0
- siemens st7 scadaconnect up to (excluding) 1.1
- siemens ruggedcom ape1808 firmware
- siemens simatic s7-1500 cpu 1518-4 pn/dp mfp firmware from 3.1.5
- siemens siplus s7-1500 cpu 1518-4 pn/dp mfp firmware from 3.1.5
- Published in the NVD
- 10 October 2023
- Last changed in the NVD
- 11 August 2026
- Severity, weakness and dates from
- NIST National Vulnerability Database (NVD)