OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability (OPC Foundation UA .NET Standard)
En bref
- Source
- NVD
- EPSS
- EPSS 1.05 % · centile 64 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- zdi
- Statut NVD
- Analyzed
Rechercher sur…
Description
OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20505.
Faiblesses (CWE)
- CWE-400 — Consommation de ressources non maîtrisée (déni de service)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | zdi |
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · zdi-disclosures@trendmicro.com (Secondary) |
Avis
- GHSA-vpf7-r2fv-75m9 — Uncontrolled Resource Consumption in OPC UA .NET Standard Reference Server
Références européennes
- ENISA EUVD · EUVD-2023-1630
- GCVE · GCVE-0-2023-27321
Avis du CERT-FR
- CERTFR-2024-AVI-0478 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:opcfoundation:ua-.netstandard:*:*:*:*:*:*:*:*< 1.4.371.86
Produits affectés
| Produit | Versions |
|---|---|
| OPC Foundation · UA .NET Standard | affected 1.4.371.60 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |