Opcfoundation
26 CVEs across 13 Opcfoundation products. Browse Opcfoundation vulnerabilities, severities, and proof-of-concept exploits.
Opcfoundation products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-42513 | Medium | 5.3 | 2025-02-10 | Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoi… |
CVE-2024-42512 | High | 8.6 | 2025-02-10 | Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Bas… |
CVE-2023-27321 | High | 7.5 | 2024-05-07 | OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a de… |
CVE-2023-31048 | Medium | 5.3 | 2023-12-12 | The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely. |
CVE-2023-32787 | High | 7.5 | 2023-05-15 | The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no l… |
CVE-2022-44725 | High | 7.8 | 2022-11-17 | OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a mal… |
CVE-2022-33916 | High | 7.5 | 2022-08-23 | OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information. |
CVE-2022-29866 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resou… |
CVE-2022-29864 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consu… |
CVE-2022-29863 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation. |
CVE-2022-29865 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials. |
CVE-2022-29862 | High | 7.5 | 2022-06-16 | An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message. |
CVE-2022-30551 | High | 7.5 | 2022-05-20 | OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available r… |
CVE-2021-45117 | Medium | 6.5 | 2022-03-21 | The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference. |
CVE-2021-40142 | High | 7.5 | 2021-08-27 | In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS) by sending carefully crafted messages… |
CVE-2021-27432 | High | 7.5 | 2021-05-20 | OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled recursion, which may allow an attacker to… |
CVE-2020-29457 | Medium | 4.4 | 2021-02-16 | A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection. |
CVE-2020-8867 | High | 7.5 | 2020-04-22 | This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Au… |
CVE-2019-19135 | High | 7.4 | 2020-03-16 | In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.35… |
CVE-2018-12087 | Medium | 5.3 | 2018-10-03 | Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over a piece of network… |
CVE-2018-12585 | High | 8.2 | 2018-09-14 | An XXE vulnerability in the OPC UA Java and .NET Legacy Stack can allow remote attackers to trigger a denial of service. |
CVE-2018-12086 | High | 7.5 | 2018-09-14 | Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests. |
CVE-2017-12070 | High | 8.8 | 2018-06-14 | Unsigned versions of the DLLs distributed by the OPC Foundation may be replaced with malicious code. |
CVE-2018-7559 | Medium | 5.3 | 2018-06-13 | An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitH… |
CVE-2017-17443 | Medium | 6.5 | 2018-06-13 | OPC Foundation Local Discovery Server (LDS) 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to trigger a crash by… |
CVE-2017-11672 | High | 7.8 | 2018-06-13 | The OPC Foundation Local Discovery Server (LDS) before 1.03.367 is installed as a Windows Service without adding double quotes around the opcualds.exe executab… |